[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Mike Pagano]

commit:     09e81ef9c8bba2841049e6eb601bbcf5db64ce6b
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Oct  1 12:34:38 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Oct  1 12:34:38 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=09e81ef9

Linux patch 4.14.200

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README               |    4 +
 1199_linux-4.14.200.patch | 6075 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 6079 insertions(+)

diff --git a/0000_README b/0000_README
index 474e30c..952497e 100644
--- a/0000_README
+++ b/0000_README
@@ -839,6 +839,10 @@ Patch:  1198_linux-4.14.199.patch
 From:   https://www.kernel.org
 Desc:   Linux 4.14.199
 
+Patch:  1199_linux-4.14.200.patch
+From:   https://www.kernel.org
+Desc:   Linux 4.14.200
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1199_linux-4.14.200.patch b/1199_linux-4.14.200.patch
new file mode 100644
index 0000000..435900c
--- /dev/null
+++ b/1199_linux-4.14.200.patch
@@ -0,0 +1,6075 @@
+diff --git a/Documentation/devicetree/bindings/sound/wm8994.txt b/Documentation/devicetree/bindings/sound/wm8994.txt
+index 68c4e8d96bed6..b309de00cd836 100644
+--- a/Documentation/devicetree/bindings/sound/wm8994.txt
++++ b/Documentation/devicetree/bindings/sound/wm8994.txt
+@@ -14,9 +14,15 @@ Required properties:
+   - #gpio-cells : Must be 2. The first cell is the pin number and the
+     second cell is used to specify optional parameters (currently unused).
+ 
+-  - AVDD2-supply, DBVDD1-supply, DBVDD2-supply, DBVDD3-supply, CPVDD-supply,
+-    SPKVDD1-supply, SPKVDD2-supply : power supplies for the device, as covered
+-    in Documentation/devicetree/bindings/regulator/regulator.txt
++  - power supplies for the device, as covered in
++    Documentation/devicetree/bindings/regulator/regulator.txt, depending
++    on compatible:
++    - for wlf,wm1811 and wlf,wm8958:
++      AVDD1-supply, AVDD2-supply, DBVDD1-supply, DBVDD2-supply, DBVDD3-supply,
++      DCVDD-supply, CPVDD-supply, SPKVDD1-supply, SPKVDD2-supply
++    - for wlf,wm8994:
++      AVDD1-supply, AVDD2-supply, DBVDD-supply, DCVDD-supply, CPVDD-supply,
++      SPKVDD1-supply, SPKVDD2-supply
+ 
+ Optional properties:
+ 
+@@ -68,11 +74,11 @@ codec: wm8994@1a {
+ 
+ 	lineout1-se;
+ 
++	AVDD1-supply = <&regulator>;
+ 	AVDD2-supply = <&regulator>;
+ 	CPVDD-supply = <&regulator>;
+-	DBVDD1-supply = <&regulator>;
+-	DBVDD2-supply = <&regulator>;
+-	DBVDD3-supply = <&regulator>;
++	DBVDD-supply = <&regulator>;
++	DCVDD-supply = <&regulator>;
+ 	SPKVDD1-supply = <&regulator>;
+ 	SPKVDD2-supply = <&regulator>;
+ };
+diff --git a/Documentation/driver-api/libata.rst b/Documentation/driver-api/libata.rst
+index 4adc056f76356..01ae89efa2bda 100644
+--- a/Documentation/driver-api/libata.rst
++++ b/Documentation/driver-api/libata.rst
+@@ -251,7 +251,7 @@ High-level taskfile hooks
+ 
+ ::
+ 
+-    void (*qc_prep) (struct ata_queued_cmd *qc);
++    enum ata_completion_errors (*qc_prep) (struct ata_queued_cmd *qc);
+     int (*qc_issue) (struct ata_queued_cmd *qc);
+ 
+ 
+diff --git a/Makefile b/Makefile
+index aaba1a2b45833..0fde7a0de1dd0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 199
++SUBLEVEL = 200
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 6b3bb67596ae8..174aa12fb8b1f 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -136,11 +136,10 @@ static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = {
+ 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_GIC_SHIFT, 4, 0),
+ 	S_ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_ASIMD_SHIFT, 4, ID_AA64PFR0_ASIMD_NI),
+ 	S_ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_FP_SHIFT, 4, ID_AA64PFR0_FP_NI),
+-	/* Linux doesn't care about the EL3 */
+ 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL3_SHIFT, 4, 0),
+-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL2_SHIFT, 4, 0),
+-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL1_SHIFT, 4, ID_AA64PFR0_EL1_64BIT_ONLY),
+-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL0_SHIFT, 4, ID_AA64PFR0_EL0_64BIT_ONLY),
++	ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL2_SHIFT, 4, 0),
++	ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL1_SHIFT, 4, ID_AA64PFR0_EL1_64BIT_ONLY),
++	ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_EL0_SHIFT, 4, ID_AA64PFR0_EL0_64BIT_ONLY),
+ 	ARM64_FTR_END,
+ };
+ 
+@@ -273,7 +272,7 @@ static const struct arm64_ftr_bits ftr_id_pfr0[] = {
+ };
+ 
+ static const struct arm64_ftr_bits ftr_id_dfr0[] = {
+-	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 28, 4, 0),
++	/* [31:28] TraceFilt */
+ 	S_ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 24, 4, 0xf),	/* PerfMon */
+ 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 20, 4, 0),
+ 	ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, 16, 4, 0),
+@@ -627,9 +626,6 @@ void update_cpu_features(int cpu,
+ 	taint |= check_update_ftr_reg(SYS_ID_AA64MMFR2_EL1, cpu,
+ 				      info->reg_id_aa64mmfr2, boot->reg_id_aa64mmfr2);
+ 
+-	/*
+-	 * EL3 is not our concern.
+-	 */
+ 	taint |= check_update_ftr_reg(SYS_ID_AA64PFR0_EL1, cpu,
+ 				      info->reg_id_aa64pfr0, boot->reg_id_aa64pfr0);
+ 	taint |= check_update_ftr_reg(SYS_ID_AA64PFR1_EL1, cpu,
+diff --git a/arch/m68k/q40/config.c b/arch/m68k/q40/config.c
+index 71c0867ecf20f..7fdf4e7799bcd 100644
+--- a/arch/m68k/q40/config.c
++++ b/arch/m68k/q40/config.c
+@@ -303,6 +303,7 @@ static int q40_get_rtc_pll(struct rtc_pll_info *pll)
+ {
+ 	int tmp = Q40_RTC_CTRL;
+ 
++	pll->pll_ctrl = 0;
+ 	pll->pll_value = tmp & Q40_RTC_PLL_MASK;
+ 	if (tmp & Q40_RTC_PLL_SIGN)
+ 		pll->pll_value = -pll->pll_value;
+diff --git a/arch/mips/include/asm/cpu-type.h b/arch/mips/include/asm/cpu-type.h
+index a45af3de075d9..d43e4ab20b238 100644
+--- a/arch/mips/include/asm/cpu-type.h
++++ b/arch/mips/include/asm/cpu-type.h
+@@ -47,6 +47,7 @@ static inline int __pure __get_cpu_type(const int cpu_type)
+ 	case CPU_34K:
+ 	case CPU_1004K:
+ 	case CPU_74K:
++	case CPU_1074K:
+ 	case CPU_M14KC:
+ 	case CPU_M14KEC:
+ 	case CPU_INTERAPTIV:
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index d2ba7936d0d33..7b46576962bfd 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -506,7 +506,7 @@ int eeh_dev_check_failure(struct eeh_dev *edev)
+ 	rc = 1;
+ 	if (pe->state & EEH_PE_ISOLATED) {
+ 		pe->check_count++;
+-		if (pe->check_count % EEH_MAX_FAILS == 0) {
++		if (pe->check_count == EEH_MAX_FAILS) {
+ 			dn = pci_device_to_OF_node(dev);
+ 			if (dn)
+ 				location = of_get_property(dn, "ibm,loc-code",
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 3c9457420aee8..0f1a888c04a84 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -357,11 +357,11 @@ out:
+ #ifdef CONFIG_PPC_BOOK3S_64
+ 	BUG_ON(get_paca()->in_nmi == 0);
+ 	if (get_paca()->in_nmi > 1)
+-		nmi_panic(regs, "Unrecoverable nested System Reset");
++		die("Unrecoverable nested System Reset", regs, SIGABRT);
+ #endif
+ 	/* Must die if the interrupt is not recoverable */
+ 	if (!(regs->msr & MSR_RI))
+-		nmi_panic(regs, "Unrecoverable System Reset");
++		die("Unrecoverable System Reset", regs, SIGABRT);
+ 
+ 	if (!nested)
+ 		nmi_exit();
+@@ -701,7 +701,7 @@ void machine_check_exception(struct pt_regs *regs)
+ 
+ 	/* Must die if the interrupt is not recoverable */
+ 	if (!(regs->msr & MSR_RI))
+-		nmi_panic(regs, "Unrecoverable Machine check");
++		die("Unrecoverable Machine check", regs, SIGBUS);
+ 
+ 	return;
+ 
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 5c2558cc6977a..42025e33a4e07 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -540,7 +540,7 @@ static struct notifier_block kdump_mem_nb = {
+ /*
+  * Make sure that the area behind memory_end is protected
+  */
+-static void reserve_memory_end(void)
++static void __init reserve_memory_end(void)
+ {
+ #ifdef CONFIG_CRASH_DUMP
+ 	if (ipl_info.type == IPL_TYPE_FCP_DUMP &&
+@@ -558,7 +558,7 @@ static void reserve_memory_end(void)
+ /*
+  * Make sure that oldmem, where the dump is stored, is protected
+  */
+-static void reserve_oldmem(void)
++static void __init reserve_oldmem(void)
+ {
+ #ifdef CONFIG_CRASH_DUMP
+ 	if (OLDMEM_BASE)
+@@ -570,7 +570,7 @@ static void reserve_oldmem(void)
+ /*
+  * Make sure that oldmem, where the dump is stored, is protected
+  */
+-static void remove_oldmem(void)
++static void __init remove_oldmem(void)
+ {
+ #ifdef CONFIG_CRASH_DUMP
+ 	if (OLDMEM_BASE)
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 041d2a04be1d8..270448b178a7a 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -330,7 +330,7 @@ DECLARE_STATIC_KEY_FALSE(mds_idle_clear);
+  * combination with microcode which triggers a CPU buffer flush when the
+  * instruction is executed.
+  */
+-static inline void mds_clear_cpu_buffers(void)
++static __always_inline void mds_clear_cpu_buffers(void)
+ {
+ 	static const u16 ds = __KERNEL_DS;
+ 
+@@ -351,7 +351,7 @@ static inline void mds_clear_cpu_buffers(void)
+  *
+  * Clear CPU buffers if the corresponding static key is enabled
+  */
+-static inline void mds_user_clear_cpu_buffers(void)
++static __always_inline void mds_user_clear_cpu_buffers(void)
+ {
+ 	if (static_branch_likely(&mds_user_clear))
+ 		mds_clear_cpu_buffers();
+diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h
+index 851c04b7a0922..1572a436bc087 100644
+--- a/arch/x86/include/asm/pkeys.h
++++ b/arch/x86/include/asm/pkeys.h
+@@ -4,6 +4,11 @@
+ 
+ #define ARCH_DEFAULT_PKEY	0
+ 
++/*
++ * If more than 16 keys are ever supported, a thorough audit
++ * will be necessary to ensure that the types that store key
++ * numbers and masks have sufficient capacity.
++ */
+ #define arch_max_pkey() (boot_cpu_has(X86_FEATURE_OSPKE) ? 16 : 1)
+ 
+ extern int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index a1c4a13782da8..be226cdd08d37 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2160,6 +2160,7 @@ static inline void __init check_timer(void)
+ 	legacy_pic->init(0);
+ 	legacy_pic->make_irq(0);
+ 	apic_write(APIC_LVT0, APIC_DM_EXTINT);
++	legacy_pic->unmask(0);
+ 
+ 	unlock_ExtINT_logic();
+ 
+diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
+index 4b900035f2202..601a5da1d196a 100644
+--- a/arch/x86/kernel/fpu/xstate.c
++++ b/arch/x86/kernel/fpu/xstate.c
+@@ -907,8 +907,6 @@ const void *get_xsave_field_ptr(int xsave_state)
+ 
+ #ifdef CONFIG_ARCH_HAS_PKEYS
+ 
+-#define NR_VALID_PKRU_BITS (CONFIG_NR_PROTECTION_KEYS * 2)
+-#define PKRU_VALID_MASK (NR_VALID_PKRU_BITS - 1)
+ /*
+  * This will go out and modify PKRU register to set the access
+  * rights for @pkey to @init_val.
+@@ -927,6 +925,13 @@ int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
+ 	if (!boot_cpu_has(X86_FEATURE_OSPKE))
+ 		return -EINVAL;
+ 
++	/*
++	 * This code should only be called with valid 'pkey'
++	 * values originating from in-kernel users.  Complain
++	 * if a bad value is observed.
++	 */
++	WARN_ON_ONCE(pkey >= arch_max_pkey());
++
+ 	/* Set the bits we need in PKRU:  */
+ 	if (init_val & PKEY_DISABLE_ACCESS)
+ 		new_pkru_bits |= PKRU_AD_BIT;
+diff --git a/arch/x86/kvm/mmutrace.h b/arch/x86/kvm/mmutrace.h
+index 918b0d5bf2724..1c1c2649829ba 100644
+--- a/arch/x86/kvm/mmutrace.h
++++ b/arch/x86/kvm/mmutrace.h
+@@ -339,7 +339,7 @@ TRACE_EVENT(
+ 		/* These depend on page entry type, so compute them now.  */
+ 		__field(bool, r)
+ 		__field(bool, x)
+-		__field(u8, u)
++		__field(signed char, u)
+ 	),
+ 
+ 	TP_fast_assign(
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 3aed03942d7d4..79fa55de635cc 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -4370,10 +4370,13 @@ long kvm_arch_vm_ioctl(struct file *filp,
+ 		r = -EFAULT;
+ 		if (copy_from_user(&u.ps, argp, sizeof u.ps))
+ 			goto out;
++		mutex_lock(&kvm->lock);
+ 		r = -ENXIO;
+ 		if (!kvm->arch.vpit)
+-			goto out;
++			goto set_pit_out;
+ 		r = kvm_vm_ioctl_set_pit(kvm, &u.ps);
++set_pit_out:
++		mutex_unlock(&kvm->lock);
+ 		break;
+ 	}
+ 	case KVM_GET_PIT2: {
+@@ -4393,10 +4396,13 @@ long kvm_arch_vm_ioctl(struct file *filp,
+ 		r = -EFAULT;
+ 		if (copy_from_user(&u.ps2, argp, sizeof(u.ps2)))
+ 			goto out;
++		mutex_lock(&kvm->lock);
+ 		r = -ENXIO;
+ 		if (!kvm->arch.vpit)
+-			goto out;
++			goto set_pit2_out;
+ 		r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2);
++set_pit2_out:
++		mutex_unlock(&kvm->lock);
+ 		break;
+ 	}
+ 	case KVM_REINJECT_CONTROL: {
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index 75d3776123cc0..2c3b4bcbe8f21 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -118,7 +118,7 @@ long __copy_user_flushcache(void *dst, const void __user *src, unsigned size)
+ 	 */
+ 	if (size < 8) {
+ 		if (!IS_ALIGNED(dest, 4) || size != 4)
+-			clean_cache_range(dst, 1);
++			clean_cache_range(dst, size);
+ 	} else {
+ 		if (!IS_ALIGNED(dest, 8)) {
+ 			dest = ALIGN(dest, boot_cpu_data.x86_clflush_size);
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index ebfc06f29f7b2..37aacb39e6922 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1062,29 +1062,21 @@ void acpi_ec_unblock_transactions(void)
+ /* --------------------------------------------------------------------------
+                                 Event Management
+    -------------------------------------------------------------------------- */
+-static struct acpi_ec_query_handler *
+-acpi_ec_get_query_handler(struct acpi_ec_query_handler *handler)
+-{
+-	if (handler)
+-		kref_get(&handler->kref);
+-	return handler;
+-}
+-
+ static struct acpi_ec_query_handler *
+ acpi_ec_get_query_handler_by_value(struct acpi_ec *ec, u8 value)
+ {
+ 	struct acpi_ec_query_handler *handler;
+-	bool found = false;
+ 
+ 	mutex_lock(&ec->mutex);
+ 	list_for_each_entry(handler, &ec->list, node) {
+ 		if (value == handler->query_bit) {
+-			found = true;
+-			break;
++			kref_get(&handler->kref);
++			mutex_unlock(&ec->mutex);
++			return handler;
+ 		}
+ 	}
+ 	mutex_unlock(&ec->mutex);
+-	return found ? acpi_ec_get_query_handler(handler) : NULL;
++	return NULL;
+ }
+ 
+ static void acpi_ec_query_handler_release(struct kref *kref)
+diff --git a/drivers/ata/acard-ahci.c b/drivers/ata/acard-ahci.c
+index 940ddbc59aa71..572848d933636 100644
+--- a/drivers/ata/acard-ahci.c
++++ b/drivers/ata/acard-ahci.c
+@@ -72,7 +72,7 @@ struct acard_sg {
+ 	__le32			size;	 /* bit 31 (EOT) max==0x10000 (64k) */
+ };
+ 
+-static void acard_ahci_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors acard_ahci_qc_prep(struct ata_queued_cmd *qc);
+ static bool acard_ahci_qc_fill_rtf(struct ata_queued_cmd *qc);
+ static int acard_ahci_port_start(struct ata_port *ap);
+ static int acard_ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+@@ -257,7 +257,7 @@ static unsigned int acard_ahci_fill_sg(struct ata_queued_cmd *qc, void *cmd_tbl)
+ 	return si;
+ }
+ 
+-static void acard_ahci_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors acard_ahci_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct ahci_port_priv *pp = ap->private_data;
+@@ -295,6 +295,8 @@ static void acard_ahci_qc_prep(struct ata_queued_cmd *qc)
+ 		opts |= AHCI_CMD_ATAPI | AHCI_CMD_PREFETCH;
+ 
+ 	ahci_fill_cmd_slot(pp, qc->tag, opts);
++
++	return AC_ERR_OK;
+ }
+ 
+ static bool acard_ahci_qc_fill_rtf(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 7473ff46de66c..1fe18a4983f0d 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -73,7 +73,7 @@ static int ahci_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
+ static bool ahci_qc_fill_rtf(struct ata_queued_cmd *qc);
+ static int ahci_port_start(struct ata_port *ap);
+ static void ahci_port_stop(struct ata_port *ap);
+-static void ahci_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors ahci_qc_prep(struct ata_queued_cmd *qc);
+ static int ahci_pmp_qc_defer(struct ata_queued_cmd *qc);
+ static void ahci_freeze(struct ata_port *ap);
+ static void ahci_thaw(struct ata_port *ap);
+@@ -1626,7 +1626,7 @@ static int ahci_pmp_qc_defer(struct ata_queued_cmd *qc)
+ 		return sata_pmp_qc_defer_cmd_switch(qc);
+ }
+ 
+-static void ahci_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors ahci_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct ahci_port_priv *pp = ap->private_data;
+@@ -1662,6 +1662,8 @@ static void ahci_qc_prep(struct ata_queued_cmd *qc)
+ 		opts |= AHCI_CMD_ATAPI | AHCI_CMD_PREFETCH;
+ 
+ 	ahci_fill_cmd_slot(pp, qc->tag, opts);
++
++	return AC_ERR_OK;
+ }
+ 
+ static void ahci_fbs_dec_intr(struct ata_port *ap)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index f90a20cad3fef..c28b0ca249075 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4986,7 +4986,10 @@ int ata_std_qc_defer(struct ata_queued_cmd *qc)
+ 	return ATA_DEFER_LINK;
+ }
+ 
+-void ata_noop_qc_prep(struct ata_queued_cmd *qc) { }
++enum ata_completion_errors ata_noop_qc_prep(struct ata_queued_cmd *qc)
++{
++	return AC_ERR_OK;
++}
+ 
+ /**
+  *	ata_sg_init - Associate command with scatter-gather table.
+@@ -5439,7 +5442,9 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
+ 		return;
+ 	}
+ 
+-	ap->ops->qc_prep(qc);
++	qc->err_mask |= ap->ops->qc_prep(qc);
++	if (unlikely(qc->err_mask))
++		goto err;
+ 	trace_ata_qc_issue(qc);
+ 	qc->err_mask |= ap->ops->qc_issue(qc);
+ 	if (unlikely(qc->err_mask))
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index 8c36ff0c2dd49..7057630ccf520 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -2725,12 +2725,14 @@ static void ata_bmdma_fill_sg_dumb(struct ata_queued_cmd *qc)
+  *	LOCKING:
+  *	spin_lock_irqsave(host lock)
+  */
+-void ata_bmdma_qc_prep(struct ata_queued_cmd *qc)
++enum ata_completion_errors ata_bmdma_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	ata_bmdma_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ EXPORT_SYMBOL_GPL(ata_bmdma_qc_prep);
+ 
+@@ -2743,12 +2745,14 @@ EXPORT_SYMBOL_GPL(ata_bmdma_qc_prep);
+  *	LOCKING:
+  *	spin_lock_irqsave(host lock)
+  */
+-void ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc)
++enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	ata_bmdma_fill_sg_dumb(qc);
++
++	return AC_ERR_OK;
+ }
+ EXPORT_SYMBOL_GPL(ata_bmdma_dumb_qc_prep);
+ 
+diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c
+index 0adcb40d2794e..054a88ecd5ba3 100644
+--- a/drivers/ata/pata_macio.c
++++ b/drivers/ata/pata_macio.c
+@@ -507,7 +507,7 @@ static int pata_macio_cable_detect(struct ata_port *ap)
+ 	return ATA_CBL_PATA40;
+ }
+ 
+-static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	unsigned int write = (qc->tf.flags & ATA_TFLAG_WRITE);
+ 	struct ata_port *ap = qc->ap;
+@@ -520,7 +520,7 @@ static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
+ 		   __func__, qc, qc->flags, write, qc->dev->devno);
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	table = (struct dbdma_cmd *) priv->dma_table_cpu;
+ 
+@@ -565,6 +565,8 @@ static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
+ 	table->command = cpu_to_le16(DBDMA_STOP);
+ 
+ 	dev_dbgdma(priv->dev, "%s: %d DMA list entries\n", __func__, pi);
++
++	return AC_ERR_OK;
+ }
+ 
+ 
+diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c
+index f6c46e9a4dc0f..d7186a503e358 100644
+--- a/drivers/ata/pata_pxa.c
++++ b/drivers/ata/pata_pxa.c
+@@ -59,25 +59,27 @@ static void pxa_ata_dma_irq(void *d)
+ /*
+  * Prepare taskfile for submission.
+  */
+-static void pxa_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pxa_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct pata_pxa_data *pd = qc->ap->private_data;
+ 	struct dma_async_tx_descriptor *tx;
+ 	enum dma_transfer_direction dir;
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	dir = (qc->dma_dir == DMA_TO_DEVICE ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM);
+ 	tx = dmaengine_prep_slave_sg(pd->dma_chan, qc->sg, qc->n_elem, dir,
+ 				     DMA_PREP_INTERRUPT);
+ 	if (!tx) {
+ 		ata_dev_err(qc->dev, "prep_slave_sg() failed\n");
+-		return;
++		return AC_ERR_OK;
+ 	}
+ 	tx->callback = pxa_ata_dma_irq;
+ 	tx->callback_param = pd;
+ 	pd->dma_cookie = dmaengine_submit(tx);
++
++	return AC_ERR_OK;
+ }
+ 
+ /*
+diff --git a/drivers/ata/pdc_adma.c b/drivers/ata/pdc_adma.c
+index f1e873a37465e..096b4771b19da 100644
+--- a/drivers/ata/pdc_adma.c
++++ b/drivers/ata/pdc_adma.c
+@@ -132,7 +132,7 @@ static int adma_ata_init_one(struct pci_dev *pdev,
+ 				const struct pci_device_id *ent);
+ static int adma_port_start(struct ata_port *ap);
+ static void adma_port_stop(struct ata_port *ap);
+-static void adma_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors adma_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int adma_qc_issue(struct ata_queued_cmd *qc);
+ static int adma_check_atapi_dma(struct ata_queued_cmd *qc);
+ static void adma_freeze(struct ata_port *ap);
+@@ -311,7 +311,7 @@ static int adma_fill_sg(struct ata_queued_cmd *qc)
+ 	return i;
+ }
+ 
+-static void adma_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors adma_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct adma_port_priv *pp = qc->ap->private_data;
+ 	u8  *buf = pp->pkt;
+@@ -322,7 +322,7 @@ static void adma_qc_prep(struct ata_queued_cmd *qc)
+ 
+ 	adma_enter_reg_mode(qc->ap);
+ 	if (qc->tf.protocol != ATA_PROT_DMA)
+-		return;
++		return AC_ERR_OK;
+ 
+ 	buf[i++] = 0;	/* Response flags */
+ 	buf[i++] = 0;	/* reserved */
+@@ -387,6 +387,7 @@ static void adma_qc_prep(struct ata_queued_cmd *qc)
+ 			printk("%s\n", obuf);
+ 	}
+ #endif
++	return AC_ERR_OK;
+ }
+ 
+ static inline void adma_packet_start(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
+index 95bf3abda6f65..5a94659064b40 100644
+--- a/drivers/ata/sata_fsl.c
++++ b/drivers/ata/sata_fsl.c
+@@ -513,7 +513,7 @@ static unsigned int sata_fsl_fill_sg(struct ata_queued_cmd *qc, void *cmd_desc,
+ 	return num_prde;
+ }
+ 
+-static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sata_fsl_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct sata_fsl_port_priv *pp = ap->private_data;
+@@ -559,6 +559,8 @@ static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
+ 
+ 	VPRINTK("SATA FSL : xx_qc_prep, di = 0x%x, ttl = %d, num_prde = %d\n",
+ 		desc_info, ttl_dwords, num_prde);
++
++	return AC_ERR_OK;
+ }
+ 
+ static unsigned int sata_fsl_qc_issue(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
+index 9b6d7930d1c79..6c7ddc037fce9 100644
+--- a/drivers/ata/sata_inic162x.c
++++ b/drivers/ata/sata_inic162x.c
+@@ -472,7 +472,7 @@ static void inic_fill_sg(struct inic_prd *prd, struct ata_queued_cmd *qc)
+ 	prd[-1].flags |= PRD_END;
+ }
+ 
+-static void inic_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors inic_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct inic_port_priv *pp = qc->ap->private_data;
+ 	struct inic_pkt *pkt = pp->pkt;
+@@ -532,6 +532,8 @@ static void inic_qc_prep(struct ata_queued_cmd *qc)
+ 		inic_fill_sg(prd, qc);
+ 
+ 	pp->cpb_tbl[0] = pp->pkt_dma;
++
++	return AC_ERR_OK;
+ }
+ 
+ static unsigned int inic_qc_issue(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index 3b2246dded74f..d85965bab2e27 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -605,8 +605,8 @@ static int mv5_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val)
+ static int mv_port_start(struct ata_port *ap);
+ static void mv_port_stop(struct ata_port *ap);
+ static int mv_qc_defer(struct ata_queued_cmd *qc);
+-static void mv_qc_prep(struct ata_queued_cmd *qc);
+-static void mv_qc_prep_iie(struct ata_queued_cmd *qc);
++static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors mv_qc_prep_iie(struct ata_queued_cmd *qc);
+ static unsigned int mv_qc_issue(struct ata_queued_cmd *qc);
+ static int mv_hardreset(struct ata_link *link, unsigned int *class,
+ 			unsigned long deadline);
+@@ -2044,7 +2044,7 @@ static void mv_rw_multi_errata_sata24(struct ata_queued_cmd *qc)
+  *      LOCKING:
+  *      Inherited from caller.
+  */
+-static void mv_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct mv_port_priv *pp = ap->private_data;
+@@ -2056,15 +2056,15 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+ 	switch (tf->protocol) {
+ 	case ATA_PROT_DMA:
+ 		if (tf->command == ATA_CMD_DSM)
+-			return;
++			return AC_ERR_OK;
+ 		/* fall-thru */
+ 	case ATA_PROT_NCQ:
+ 		break;	/* continue below */
+ 	case ATA_PROT_PIO:
+ 		mv_rw_multi_errata_sata24(qc);
+-		return;
++		return AC_ERR_OK;
+ 	default:
+-		return;
++		return AC_ERR_OK;
+ 	}
+ 
+ 	/* Fill in command request block
+@@ -2111,12 +2111,10 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+ 		 * non-NCQ mode are: [RW] STREAM DMA and W DMA FUA EXT, none
+ 		 * of which are defined/used by Linux.  If we get here, this
+ 		 * driver needs work.
+-		 *
+-		 * FIXME: modify libata to give qc_prep a return value and
+-		 * return error here.
+ 		 */
+-		BUG_ON(tf->command);
+-		break;
++		ata_port_err(ap, "%s: unsupported command: %.2x\n", __func__,
++				tf->command);
++		return AC_ERR_INVALID;
+ 	}
+ 	mv_crqb_pack_cmd(cw++, tf->nsect, ATA_REG_NSECT, 0);
+ 	mv_crqb_pack_cmd(cw++, tf->hob_lbal, ATA_REG_LBAL, 0);
+@@ -2129,8 +2127,10 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+ 	mv_crqb_pack_cmd(cw++, tf->command, ATA_REG_CMD, 1);	/* last */
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 	mv_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ 
+ /**
+@@ -2145,7 +2145,7 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+  *      LOCKING:
+  *      Inherited from caller.
+  */
+-static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
++static enum ata_completion_errors mv_qc_prep_iie(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct mv_port_priv *pp = ap->private_data;
+@@ -2156,9 +2156,9 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
+ 
+ 	if ((tf->protocol != ATA_PROT_DMA) &&
+ 	    (tf->protocol != ATA_PROT_NCQ))
+-		return;
++		return AC_ERR_OK;
+ 	if (tf->command == ATA_CMD_DSM)
+-		return;  /* use bmdma for this */
++		return AC_ERR_OK;  /* use bmdma for this */
+ 
+ 	/* Fill in Gen IIE command request block */
+ 	if (!(tf->flags & ATA_TFLAG_WRITE))
+@@ -2199,8 +2199,10 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
+ 		);
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 	mv_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ 
+ /**
+diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
+index 8c683ddd0f580..efd5a0592855b 100644
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -313,7 +313,7 @@ static void nv_ck804_freeze(struct ata_port *ap);
+ static void nv_ck804_thaw(struct ata_port *ap);
+ static int nv_adma_slave_config(struct scsi_device *sdev);
+ static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc);
+-static void nv_adma_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors nv_adma_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int nv_adma_qc_issue(struct ata_queued_cmd *qc);
+ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance);
+ static void nv_adma_irq_clear(struct ata_port *ap);
+@@ -335,7 +335,7 @@ static void nv_mcp55_freeze(struct ata_port *ap);
+ static void nv_swncq_error_handler(struct ata_port *ap);
+ static int nv_swncq_slave_config(struct scsi_device *sdev);
+ static int nv_swncq_port_start(struct ata_port *ap);
+-static void nv_swncq_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors nv_swncq_qc_prep(struct ata_queued_cmd *qc);
+ static void nv_swncq_fill_sg(struct ata_queued_cmd *qc);
+ static unsigned int nv_swncq_qc_issue(struct ata_queued_cmd *qc);
+ static void nv_swncq_irq_clear(struct ata_port *ap, u16 fis);
+@@ -1382,7 +1382,7 @@ static int nv_adma_use_reg_mode(struct ata_queued_cmd *qc)
+ 	return 1;
+ }
+ 
+-static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors nv_adma_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct nv_adma_port_priv *pp = qc->ap->private_data;
+ 	struct nv_adma_cpb *cpb = &pp->cpb[qc->tag];
+@@ -1394,7 +1394,7 @@ static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
+ 			(qc->flags & ATA_QCFLAG_DMAMAP));
+ 		nv_adma_register_mode(qc->ap);
+ 		ata_bmdma_qc_prep(qc);
+-		return;
++		return AC_ERR_OK;
+ 	}
+ 
+ 	cpb->resp_flags = NV_CPB_RESP_DONE;
+@@ -1426,6 +1426,8 @@ static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
+ 	cpb->ctl_flags = ctl_flags;
+ 	wmb();
+ 	cpb->resp_flags = 0;
++
++	return AC_ERR_OK;
+ }
+ 
+ static unsigned int nv_adma_qc_issue(struct ata_queued_cmd *qc)
+@@ -1989,17 +1991,19 @@ static int nv_swncq_port_start(struct ata_port *ap)
+ 	return 0;
+ }
+ 
+-static void nv_swncq_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors nv_swncq_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	if (qc->tf.protocol != ATA_PROT_NCQ) {
+ 		ata_bmdma_qc_prep(qc);
+-		return;
++		return AC_ERR_OK;
+ 	}
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	nv_swncq_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ 
+ static void nv_swncq_fill_sg(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
+index d032bf657f709..29d2bb465f60d 100644
+--- a/drivers/ata/sata_promise.c
++++ b/drivers/ata/sata_promise.c
+@@ -155,7 +155,7 @@ static int pdc_sata_scr_write(struct ata_link *link, unsigned int sc_reg, u32 va
+ static int pdc_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int pdc_common_port_start(struct ata_port *ap);
+ static int pdc_sata_port_start(struct ata_port *ap);
+-static void pdc_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors pdc_qc_prep(struct ata_queued_cmd *qc);
+ static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static int pdc_check_atapi_dma(struct ata_queued_cmd *qc);
+@@ -649,7 +649,7 @@ static void pdc_fill_sg(struct ata_queued_cmd *qc)
+ 	prd[idx - 1].flags_len |= cpu_to_le32(ATA_PRD_EOT);
+ }
+ 
+-static void pdc_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pdc_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct pdc_port_priv *pp = qc->ap->private_data;
+ 	unsigned int i;
+@@ -681,6 +681,8 @@ static void pdc_qc_prep(struct ata_queued_cmd *qc)
+ 	default:
+ 		break;
+ 	}
++
++	return AC_ERR_OK;
+ }
+ 
+ static int pdc_is_sataii_tx4(unsigned long flags)
+diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
+index 1fe941688e95d..a66d10628c183 100644
+--- a/drivers/ata/sata_qstor.c
++++ b/drivers/ata/sata_qstor.c
+@@ -116,7 +116,7 @@ static int qs_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
+ static int qs_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int qs_port_start(struct ata_port *ap);
+ static void qs_host_stop(struct ata_host *host);
+-static void qs_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors qs_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int qs_qc_issue(struct ata_queued_cmd *qc);
+ static int qs_check_atapi_dma(struct ata_queued_cmd *qc);
+ static void qs_freeze(struct ata_port *ap);
+@@ -276,7 +276,7 @@ static unsigned int qs_fill_sg(struct ata_queued_cmd *qc)
+ 	return si;
+ }
+ 
+-static void qs_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors qs_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct qs_port_priv *pp = qc->ap->private_data;
+ 	u8 dflags = QS_DF_PORD, *buf = pp->pkt;
+@@ -288,7 +288,7 @@ static void qs_qc_prep(struct ata_queued_cmd *qc)
+ 
+ 	qs_enter_reg_mode(qc->ap);
+ 	if (qc->tf.protocol != ATA_PROT_DMA)
+-		return;
++		return AC_ERR_OK;
+ 
+ 	nelem = qs_fill_sg(qc);
+ 
+@@ -311,6 +311,8 @@ static void qs_qc_prep(struct ata_queued_cmd *qc)
+ 
+ 	/* frame information structure (FIS) */
+ 	ata_tf_to_fis(&qc->tf, 0, 1, &buf[32]);
++
++	return AC_ERR_OK;
+ }
+ 
+ static inline void qs_packet_start(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
+index 3e82a4ac239e7..a443c69434732 100644
+--- a/drivers/ata/sata_rcar.c
++++ b/drivers/ata/sata_rcar.c
+@@ -551,12 +551,14 @@ static void sata_rcar_bmdma_fill_sg(struct ata_queued_cmd *qc)
+ 	prd[si - 1].addr |= cpu_to_le32(SATA_RCAR_DTEND);
+ }
+ 
+-static void sata_rcar_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sata_rcar_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	sata_rcar_bmdma_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ 
+ static void sata_rcar_bmdma_setup(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
+index ed76f070d21e4..82adaf02887fb 100644
+--- a/drivers/ata/sata_sil.c
++++ b/drivers/ata/sata_sil.c
+@@ -119,7 +119,7 @@ static void sil_dev_config(struct ata_device *dev);
+ static int sil_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
+ static int sil_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
+ static int sil_set_mode(struct ata_link *link, struct ata_device **r_failed);
+-static void sil_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors sil_qc_prep(struct ata_queued_cmd *qc);
+ static void sil_bmdma_setup(struct ata_queued_cmd *qc);
+ static void sil_bmdma_start(struct ata_queued_cmd *qc);
+ static void sil_bmdma_stop(struct ata_queued_cmd *qc);
+@@ -333,12 +333,14 @@ static void sil_fill_sg(struct ata_queued_cmd *qc)
+ 		last_prd->flags_len |= cpu_to_le32(ATA_PRD_EOT);
+ }
+ 
+-static void sil_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sil_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	sil_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ 
+ static unsigned char sil_get_device_cache_line(struct pci_dev *pdev)
+diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
+index 4b1995e2d044b..ffa3bf724054d 100644
+--- a/drivers/ata/sata_sil24.c
++++ b/drivers/ata/sata_sil24.c
+@@ -336,7 +336,7 @@ static void sil24_dev_config(struct ata_device *dev);
+ static int sil24_scr_read(struct ata_link *link, unsigned sc_reg, u32 *val);
+ static int sil24_scr_write(struct ata_link *link, unsigned sc_reg, u32 val);
+ static int sil24_qc_defer(struct ata_queued_cmd *qc);
+-static void sil24_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc);
+ static bool sil24_qc_fill_rtf(struct ata_queued_cmd *qc);
+ static void sil24_pmp_attach(struct ata_port *ap);
+@@ -840,7 +840,7 @@ static int sil24_qc_defer(struct ata_queued_cmd *qc)
+ 	return ata_std_qc_defer(qc);
+ }
+ 
+-static void sil24_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct sil24_port_priv *pp = ap->private_data;
+@@ -884,6 +884,8 @@ static void sil24_qc_prep(struct ata_queued_cmd *qc)
+ 
+ 	if (qc->flags & ATA_QCFLAG_DMAMAP)
+ 		sil24_fill_sg(qc, sge);
++
++	return AC_ERR_OK;
+ }
+ 
+ static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
+index 405e606a234d1..0d742457925ec 100644
+--- a/drivers/ata/sata_sx4.c
++++ b/drivers/ata/sata_sx4.c
+@@ -218,7 +218,7 @@ static void pdc_error_handler(struct ata_port *ap);
+ static void pdc_freeze(struct ata_port *ap);
+ static void pdc_thaw(struct ata_port *ap);
+ static int pdc_port_start(struct ata_port *ap);
+-static void pdc20621_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors pdc20621_qc_prep(struct ata_queued_cmd *qc);
+ static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static unsigned int pdc20621_dimm_init(struct ata_host *host);
+@@ -546,7 +546,7 @@ static void pdc20621_nodata_prep(struct ata_queued_cmd *qc)
+ 	VPRINTK("ata pkt buf ofs %u, mmio copied\n", i);
+ }
+ 
+-static void pdc20621_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pdc20621_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	switch (qc->tf.protocol) {
+ 	case ATA_PROT_DMA:
+@@ -558,6 +558,8 @@ static void pdc20621_qc_prep(struct ata_queued_cmd *qc)
+ 	default:
+ 		break;
+ 	}
++
++	return AC_ERR_OK;
+ }
+ 
+ static void __pdc20621_push_hdma(struct ata_queued_cmd *qc,
+diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
+index a106d15f6def0..ba549d9454799 100644
+--- a/drivers/atm/eni.c
++++ b/drivers/atm/eni.c
+@@ -2243,7 +2243,7 @@ static int eni_init_one(struct pci_dev *pci_dev,
+ 
+ 	rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(32));
+ 	if (rc < 0)
+-		goto out;
++		goto err_disable;
+ 
+ 	rc = -ENOMEM;
+ 	eni_dev = kmalloc(sizeof(struct eni_dev), GFP_KERNEL);
+diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
+index 6210bff46341e..52fadc46e7a97 100644
+--- a/drivers/char/tlclk.c
++++ b/drivers/char/tlclk.c
+@@ -777,17 +777,21 @@ static int __init tlclk_init(void)
+ {
+ 	int ret;
+ 
++	telclk_interrupt = (inb(TLCLK_REG7) & 0x0f);
++
++	alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
++	if (!alarm_events) {
++		ret = -ENOMEM;
++		goto out1;
++	}
++
+ 	ret = register_chrdev(tlclk_major, "telco_clock", &tlclk_fops);
+ 	if (ret < 0) {
+ 		printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major);
++		kfree(alarm_events);
+ 		return ret;
+ 	}
+ 	tlclk_major = ret;
+-	alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
+-	if (!alarm_events) {
+-		ret = -ENOMEM;
+-		goto out1;
+-	}
+ 
+ 	/* Read telecom clock IRQ number (Set by BIOS) */
+ 	if (!request_region(TLCLK_BASE, 8, "telco_clock")) {
+@@ -796,7 +800,6 @@ static int __init tlclk_init(void)
+ 		ret = -EBUSY;
+ 		goto out2;
+ 	}
+-	telclk_interrupt = (inb(TLCLK_REG7) & 0x0f);
+ 
+ 	if (0x0F == telclk_interrupt ) { /* not MCPBL0010 ? */
+ 		printk(KERN_ERR "telclk_interrupt = 0x%x non-mcpbl0010 hw.\n",
+@@ -837,8 +840,8 @@ out3:
+ 	release_region(TLCLK_BASE, 8);
+ out2:
+ 	kfree(alarm_events);
+-out1:
+ 	unregister_chrdev(tlclk_major, "telco_clock");
++out1:
+ 	return ret;
+ }
+ 
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 569e93e1f06cc..3ba67bc6baba0 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -588,6 +588,7 @@ static irqreturn_t ibmvtpm_interrupt(int irq, void *vtpm_instance)
+ 	 */
+ 	while ((crq = ibmvtpm_crq_get_next(ibmvtpm)) != NULL) {
+ 		ibmvtpm_crq_process(crq, ibmvtpm);
++		wake_up_interruptible(&ibmvtpm->crq_queue.wq);
+ 		crq->valid = 0;
+ 		smp_wmb();
+ 	}
+@@ -635,6 +636,7 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ 	}
+ 
+ 	crq_q->num_entry = CRQ_RES_BUF_SIZE / sizeof(*crq_q->crq_addr);
++	init_waitqueue_head(&crq_q->wq);
+ 	ibmvtpm->crq_dma_handle = dma_map_single(dev, crq_q->crq_addr,
+ 						 CRQ_RES_BUF_SIZE,
+ 						 DMA_BIDIRECTIONAL);
+@@ -687,6 +689,13 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ 	if (rc)
+ 		goto init_irq_cleanup;
+ 
++	if (!wait_event_timeout(ibmvtpm->crq_queue.wq,
++				ibmvtpm->rtce_buf != NULL,
++				HZ)) {
++		dev_err(dev, "CRQ response timed out\n");
++		goto init_irq_cleanup;
++	}
++
+ 	return tpm_chip_register(chip);
+ init_irq_cleanup:
+ 	do {
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
+index 91dfe766d0800..4f6a124601db4 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.h
++++ b/drivers/char/tpm/tpm_ibmvtpm.h
+@@ -31,6 +31,7 @@ struct ibmvtpm_crq_queue {
+ 	struct ibmvtpm_crq *crq_addr;
+ 	u32 index;
+ 	u32 num_entry;
++	wait_queue_head_t wq;
+ };
+ 
+ struct ibmvtpm_dev {
+diff --git a/drivers/clk/ti/adpll.c b/drivers/clk/ti/adpll.c
+index d6036c788fab8..2738ecb1511b1 100644
+--- a/drivers/clk/ti/adpll.c
++++ b/drivers/clk/ti/adpll.c
+@@ -193,15 +193,8 @@ static const char *ti_adpll_clk_get_name(struct ti_adpll_data *d,
+ 		if (err)
+ 			return NULL;
+ 	} else {
+-		const char *base_name = "adpll";
+-		char *buf;
+-
+-		buf = devm_kzalloc(d->dev, 8 + 1 + strlen(base_name) + 1 +
+-				    strlen(postfix), GFP_KERNEL);
+-		if (!buf)
+-			return NULL;
+-		sprintf(buf, "%08lx.%s.%s", d->pa, base_name, postfix);
+-		name = buf;
++		name = devm_kasprintf(d->dev, GFP_KERNEL, "%08lx.adpll.%s",
++				      d->pa, postfix);
+ 	}
+ 
+ 	return name;
+diff --git a/drivers/clocksource/h8300_timer8.c b/drivers/clocksource/h8300_timer8.c
+index 1d740a8c42ab3..47114c2a7cb54 100644
+--- a/drivers/clocksource/h8300_timer8.c
++++ b/drivers/clocksource/h8300_timer8.c
+@@ -169,7 +169,7 @@ static int __init h8300_8timer_init(struct device_node *node)
+ 		return PTR_ERR(clk);
+ 	}
+ 
+-	ret = ENXIO;
++	ret = -ENXIO;
+ 	base = of_iomap(node, 0);
+ 	if (!base) {
+ 		pr_err("failed to map registers for clockevent\n");
+diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
+index 25c9a6cdd8614..dc81fc2bf8015 100644
+--- a/drivers/cpufreq/powernv-cpufreq.c
++++ b/drivers/cpufreq/powernv-cpufreq.c
+@@ -864,6 +864,7 @@ static struct notifier_block powernv_cpufreq_reboot_nb = {
+ void powernv_cpufreq_work_fn(struct work_struct *work)
+ {
+ 	struct chip *chip = container_of(work, struct chip, throttle);
++	struct cpufreq_policy *policy;
+ 	unsigned int cpu;
+ 	cpumask_t mask;
+ 
+@@ -878,12 +879,14 @@ void powernv_cpufreq_work_fn(struct work_struct *work)
+ 	chip->restore = false;
+ 	for_each_cpu(cpu, &mask) {
+ 		int index;
+-		struct cpufreq_policy policy;
+ 
+-		cpufreq_get_policy(&policy, cpu);
+-		index = cpufreq_table_find_index_c(&policy, policy.cur);
+-		powernv_cpufreq_target_index(&policy, index);
+-		cpumask_andnot(&mask, &mask, policy.cpus);
++		policy = cpufreq_cpu_get(cpu);
++		if (!policy)
++			continue;
++		index = cpufreq_table_find_index_c(policy, policy->cur);
++		powernv_cpufreq_target_index(policy, index);
++		cpumask_andnot(&mask, &mask, policy->cpus);
++		cpufreq_cpu_put(policy);
+ 	}
+ out:
+ 	put_online_cpus();
+diff --git a/drivers/devfreq/tegra-devfreq.c b/drivers/devfreq/tegra-devfreq.c
+index 6627a7dce95c4..f6a2dd6b188fa 100644
+--- a/drivers/devfreq/tegra-devfreq.c
++++ b/drivers/devfreq/tegra-devfreq.c
+@@ -79,6 +79,8 @@
+ 
+ #define KHZ							1000
+ 
++#define KHZ_MAX						(ULONG_MAX / KHZ)
++
+ /* Assume that the bus is saturated if the utilization is 25% */
+ #define BUS_SATURATION_RATIO					25
+ 
+@@ -179,7 +181,7 @@ struct tegra_actmon_emc_ratio {
+ };
+ 
+ static struct tegra_actmon_emc_ratio actmon_emc_ratios[] = {
+-	{ 1400000, ULONG_MAX },
++	{ 1400000,    KHZ_MAX },
+ 	{ 1200000,    750000 },
+ 	{ 1100000,    600000 },
+ 	{ 1000000,    500000 },
+diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
+index 3402494cadf99..78e098b4bd89e 100644
+--- a/drivers/dma/tegra20-apb-dma.c
++++ b/drivers/dma/tegra20-apb-dma.c
+@@ -1208,8 +1208,7 @@ static void tegra_dma_free_chan_resources(struct dma_chan *dc)
+ 
+ 	dev_dbg(tdc2dev(tdc), "Freeing channel %d\n", tdc->id);
+ 
+-	if (tdc->busy)
+-		tegra_dma_terminate_all(dc);
++	tegra_dma_terminate_all(dc);
+ 
+ 	spin_lock_irqsave(&tdc->lock, flags);
+ 	list_splice_init(&tdc->pending_sg_req, &sg_req_list);
+diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
+index 6d86d05e53aa1..66d6640766ed8 100644
+--- a/drivers/dma/xilinx/zynqmp_dma.c
++++ b/drivers/dma/xilinx/zynqmp_dma.c
+@@ -125,10 +125,12 @@
+ /* Max transfer size per descriptor */
+ #define ZYNQMP_DMA_MAX_TRANS_LEN	0x40000000
+ 
++/* Max burst lengths */
++#define ZYNQMP_DMA_MAX_DST_BURST_LEN    32768U
++#define ZYNQMP_DMA_MAX_SRC_BURST_LEN    32768U
++
+ /* Reset values for data attributes */
+ #define ZYNQMP_DMA_AXCACHE_VAL		0xF
+-#define ZYNQMP_DMA_ARLEN_RST_VAL	0xF
+-#define ZYNQMP_DMA_AWLEN_RST_VAL	0xF
+ 
+ #define ZYNQMP_DMA_SRC_ISSUE_RST_VAL	0x1F
+ 
+@@ -527,17 +529,19 @@ static void zynqmp_dma_handle_ovfl_int(struct zynqmp_dma_chan *chan, u32 status)
+ 
+ static void zynqmp_dma_config(struct zynqmp_dma_chan *chan)
+ {
+-	u32 val;
++	u32 val, burst_val;
+ 
+ 	val = readl(chan->regs + ZYNQMP_DMA_CTRL0);
+ 	val |= ZYNQMP_DMA_POINT_TYPE_SG;
+ 	writel(val, chan->regs + ZYNQMP_DMA_CTRL0);
+ 
+ 	val = readl(chan->regs + ZYNQMP_DMA_DATA_ATTR);
++	burst_val = __ilog2_u32(chan->src_burst_len);
+ 	val = (val & ~ZYNQMP_DMA_ARLEN) |
+-		(chan->src_burst_len << ZYNQMP_DMA_ARLEN_OFST);
++		((burst_val << ZYNQMP_DMA_ARLEN_OFST) & ZYNQMP_DMA_ARLEN);
++	burst_val = __ilog2_u32(chan->dst_burst_len);
+ 	val = (val & ~ZYNQMP_DMA_AWLEN) |
+-		(chan->dst_burst_len << ZYNQMP_DMA_AWLEN_OFST);
++		((burst_val << ZYNQMP_DMA_AWLEN_OFST) & ZYNQMP_DMA_AWLEN);
+ 	writel(val, chan->regs + ZYNQMP_DMA_DATA_ATTR);
+ }
+ 
+@@ -551,8 +555,10 @@ static int zynqmp_dma_device_config(struct dma_chan *dchan,
+ {
+ 	struct zynqmp_dma_chan *chan = to_chan(dchan);
+ 
+-	chan->src_burst_len = config->src_maxburst;
+-	chan->dst_burst_len = config->dst_maxburst;
++	chan->src_burst_len = clamp(config->src_maxburst, 1U,
++		ZYNQMP_DMA_MAX_SRC_BURST_LEN);
++	chan->dst_burst_len = clamp(config->dst_maxburst, 1U,
++		ZYNQMP_DMA_MAX_DST_BURST_LEN);
+ 
+ 	return 0;
+ }
+@@ -873,8 +879,8 @@ static int zynqmp_dma_chan_probe(struct zynqmp_dma_device *zdev,
+ 		return PTR_ERR(chan->regs);
+ 
+ 	chan->bus_width = ZYNQMP_DMA_BUS_WIDTH_64;
+-	chan->dst_burst_len = ZYNQMP_DMA_AWLEN_RST_VAL;
+-	chan->src_burst_len = ZYNQMP_DMA_ARLEN_RST_VAL;
++	chan->dst_burst_len = ZYNQMP_DMA_MAX_DST_BURST_LEN;
++	chan->src_burst_len = ZYNQMP_DMA_MAX_SRC_BURST_LEN;
+ 	err = of_property_read_u32(node, "xlnx,bus-width", &chan->bus_width);
+ 	if (err < 0) {
+ 		dev_err(&pdev->dev, "missing xlnx,bus-width property\n");
+diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
+index d69aa2e179bbe..e4874cc209ef4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/atom.c
++++ b/drivers/gpu/drm/amd/amdgpu/atom.c
+@@ -742,8 +742,8 @@ static void atom_op_jump(atom_exec_context *ctx, int *ptr, int arg)
+ 			cjiffies = jiffies;
+ 			if (time_after(cjiffies, ctx->last_jump_jiffies)) {
+ 				cjiffies -= ctx->last_jump_jiffies;
+-				if ((jiffies_to_msecs(cjiffies) > 5000)) {
+-					DRM_ERROR("atombios stuck in loop for more than 5secs aborting\n");
++				if ((jiffies_to_msecs(cjiffies) > 10000)) {
++					DRM_ERROR("atombios stuck in loop for more than 10secs aborting\n");
+ 					ctx->abort = true;
+ 				}
+ 			} else {
+diff --git a/drivers/gpu/drm/gma500/cdv_intel_display.c b/drivers/gpu/drm/gma500/cdv_intel_display.c
+index 17db4b4749d5a..2e8479744ca4a 100644
+--- a/drivers/gpu/drm/gma500/cdv_intel_display.c
++++ b/drivers/gpu/drm/gma500/cdv_intel_display.c
+@@ -415,6 +415,8 @@ static bool cdv_intel_find_dp_pll(const struct gma_limit_t *limit,
+ 	struct gma_crtc *gma_crtc = to_gma_crtc(crtc);
+ 	struct gma_clock_t clock;
+ 
++	memset(&clock, 0, sizeof(clock));
++
+ 	switch (refclk) {
+ 	case 27000:
+ 		if (target < 200000) {
+diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+index 9635704a1d864..4561a786fab07 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c
++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+@@ -161,8 +161,11 @@ nouveau_debugfs_pstate_set(struct file *file, const char __user *ubuf,
+ 	}
+ 
+ 	ret = pm_runtime_get_sync(drm->dev);
+-	if (ret < 0 && ret != -EACCES)
++	if (ret < 0 && ret != -EACCES) {
++		pm_runtime_put_autosuspend(drm->dev);
+ 		return ret;
++	}
++
+ 	ret = nvif_mthd(ctrl, NVIF_CONTROL_PSTATE_USER, &args, sizeof(args));
+ 	pm_runtime_put_autosuspend(drm->dev);
+ 	if (ret < 0)
+diff --git a/drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c b/drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c
+index bf626acae2712..cd8e9b799b9a5 100644
+--- a/drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c
++++ b/drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c
+@@ -193,7 +193,7 @@ static int __init omapdss_boot_init(void)
+ 	dss = of_find_matching_node(NULL, omapdss_of_match);
+ 
+ 	if (dss == NULL || !of_device_is_available(dss))
+-		return 0;
++		goto put_node;
+ 
+ 	omapdss_walk_device(dss, true);
+ 
+@@ -218,6 +218,8 @@ static int __init omapdss_boot_init(void)
+ 		kfree(n);
+ 	}
+ 
++put_node:
++	of_node_put(dss);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 8f71157a2b063..3020ae7a8f6b1 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1115,6 +1115,7 @@ static int vc4_hdmi_audio_init(struct vc4_hdmi *hdmi)
+ 	card->num_links = 1;
+ 	card->name = "vc4-hdmi";
+ 	card->dev = dev;
++	card->owner = THIS_MODULE;
+ 
+ 	/*
+ 	 * Be careful, snd_soc_register_card() calls dev_set_drvdata() and
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 7b961c9c62eff..9f2aa45560e62 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -1280,8 +1280,8 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
+ 
+ 	/* create pre-declared device nodes */
+ 	of_i2c_register_devices(adap);
+-	i2c_acpi_register_devices(adap);
+ 	i2c_acpi_install_space_handler(adap);
++	i2c_acpi_register_devices(adap);
+ 
+ 	if (adap->nr < __i2c_first_dynamic_bus_num)
+ 		i2c_scan_static_board_info(adap);
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index c3e5f921da12e..4002a8ddf6d0a 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -1315,13 +1315,13 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
+ 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+ 		return -EFAULT;
+ 
++	if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
++		return -EINVAL;
++
+ 	ctx = ucma_get_ctx(file, cmd.id);
+ 	if (IS_ERR(ctx))
+ 		return PTR_ERR(ctx);
+ 
+-	if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
+-		return -EINVAL;
+-
+ 	optval = memdup_user((void __user *) (unsigned long) cmd.optval,
+ 			     cmd.optlen);
+ 	if (IS_ERR(optval)) {
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 7eb1cc1b1aa04..5aa545f9a4232 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -3265,7 +3265,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ 		if (raddr->sin_addr.s_addr == htonl(INADDR_ANY)) {
+ 			err = pick_local_ipaddrs(dev, cm_id);
+ 			if (err)
+-				goto fail2;
++				goto fail3;
+ 		}
+ 
+ 		/* find a route */
+@@ -3287,7 +3287,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ 		if (ipv6_addr_type(&raddr6->sin6_addr) == IPV6_ADDR_ANY) {
+ 			err = pick_local_ip6addrs(dev, cm_id);
+ 			if (err)
+-				goto fail2;
++				goto fail3;
+ 		}
+ 
+ 		/* find a route */
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+index 880c63579ba88..adec03412506d 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+@@ -2052,9 +2052,9 @@ static int i40iw_addr_resolve_neigh_ipv6(struct i40iw_device *iwdev,
+ 	dst = i40iw_get_dst_ipv6(&src_addr, &dst_addr);
+ 	if (!dst || dst->error) {
+ 		if (dst) {
+-			dst_release(dst);
+ 			i40iw_pr_err("ip6_route_output returned dst->error = %d\n",
+ 				     dst->error);
++			dst_release(dst);
+ 		}
+ 		return rc;
+ 	}
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index 25267a620e0b5..e6770e5c1432c 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -126,6 +126,8 @@ static int rxe_init_device_param(struct rxe_dev *rxe)
+ 	rxe->attr.max_fast_reg_page_list_len	= RXE_MAX_FMR_PAGE_LIST_LEN;
+ 	rxe->attr.max_pkeys			= RXE_MAX_PKEYS;
+ 	rxe->attr.local_ca_ack_delay		= RXE_LOCAL_CA_ACK_DELAY;
++	addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid,
++			rxe->ndev->dev_addr);
+ 
+ 	rxe->max_ucontext			= RXE_MAX_UCONTEXT;
+ 
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 25055a68a2c07..ef7fd5dfad468 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -593,15 +593,16 @@ int rxe_qp_from_attr(struct rxe_qp *qp, struct ib_qp_attr *attr, int mask,
+ 	struct ib_gid_attr sgid_attr;
+ 
+ 	if (mask & IB_QP_MAX_QP_RD_ATOMIC) {
+-		int max_rd_atomic = __roundup_pow_of_two(attr->max_rd_atomic);
++		int max_rd_atomic = attr->max_rd_atomic ?
++			roundup_pow_of_two(attr->max_rd_atomic) : 0;
+ 
+ 		qp->attr.max_rd_atomic = max_rd_atomic;
+ 		atomic_set(&qp->req.rd_atomic, max_rd_atomic);
+ 	}
+ 
+ 	if (mask & IB_QP_MAX_DEST_RD_ATOMIC) {
+-		int max_dest_rd_atomic =
+-			__roundup_pow_of_two(attr->max_dest_rd_atomic);
++		int max_dest_rd_atomic = attr->max_dest_rd_atomic ?
++			roundup_pow_of_two(attr->max_dest_rd_atomic) : 0;
+ 
+ 		qp->attr.max_dest_rd_atomic = max_dest_rd_atomic;
+ 
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index e4a3f692057b8..a3763d664a67a 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -548,6 +548,7 @@ struct cache_set {
+ 	 */
+ 	wait_queue_head_t	btree_cache_wait;
+ 	struct task_struct	*btree_cache_alloc_lock;
++	spinlock_t		btree_cannibalize_lock;
+ 
+ 	/*
+ 	 * When we free a btree node, we increment the gen of the bucket the
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 9fca837d0b41e..fba0fff8040d6 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -840,15 +840,17 @@ out:
+ 
+ static int mca_cannibalize_lock(struct cache_set *c, struct btree_op *op)
+ {
+-	struct task_struct *old;
+-
+-	old = cmpxchg(&c->btree_cache_alloc_lock, NULL, current);
+-	if (old && old != current) {
++	spin_lock(&c->btree_cannibalize_lock);
++	if (likely(c->btree_cache_alloc_lock == NULL)) {
++		c->btree_cache_alloc_lock = current;
++	} else if (c->btree_cache_alloc_lock != current) {
+ 		if (op)
+ 			prepare_to_wait(&c->btree_cache_wait, &op->wait,
+ 					TASK_UNINTERRUPTIBLE);
++		spin_unlock(&c->btree_cannibalize_lock);
+ 		return -EINTR;
+ 	}
++	spin_unlock(&c->btree_cannibalize_lock);
+ 
+ 	return 0;
+ }
+@@ -883,10 +885,12 @@ static struct btree *mca_cannibalize(struct cache_set *c, struct btree_op *op,
+  */
+ static void bch_cannibalize_unlock(struct cache_set *c)
+ {
++	spin_lock(&c->btree_cannibalize_lock);
+ 	if (c->btree_cache_alloc_lock == current) {
+ 		c->btree_cache_alloc_lock = NULL;
+ 		wake_up(&c->btree_cache_wait);
+ 	}
++	spin_unlock(&c->btree_cannibalize_lock);
+ }
+ 
+ static struct btree *mca_alloc(struct cache_set *c, struct btree_op *op,
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 7fcc1ba12bc01..6bf1559a1f0db 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1510,6 +1510,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
+ 	sema_init(&c->sb_write_mutex, 1);
+ 	mutex_init(&c->bucket_lock);
+ 	init_waitqueue_head(&c->btree_cache_wait);
++	spin_lock_init(&c->btree_cannibalize_lock);
+ 	init_waitqueue_head(&c->bucket_wait);
+ 	init_waitqueue_head(&c->gc_wait);
+ 	sema_init(&c->uuid_write_mutex, 1);
+diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
+index a59f4fd09df60..27466b0d0be86 100644
+--- a/drivers/media/dvb-frontends/tda10071.c
++++ b/drivers/media/dvb-frontends/tda10071.c
+@@ -483,10 +483,11 @@ static int tda10071_read_status(struct dvb_frontend *fe, enum fe_status *status)
+ 			goto error;
+ 
+ 		if (dev->delivery_system == SYS_DVBS) {
+-			dev->dvbv3_ber = buf[0] << 24 | buf[1] << 16 |
+-					 buf[2] << 8 | buf[3] << 0;
+-			dev->post_bit_error += buf[0] << 24 | buf[1] << 16 |
+-					       buf[2] << 8 | buf[3] << 0;
++			u32 bit_error = buf[0] << 24 | buf[1] << 16 |
++					buf[2] << 8 | buf[3] << 0;
++
++			dev->dvbv3_ber = bit_error;
++			dev->post_bit_error += bit_error;
+ 			c->post_bit_error.stat[0].scale = FE_SCALE_COUNTER;
+ 			c->post_bit_error.stat[0].uvalue = dev->post_bit_error;
+ 			dev->block_error += buf[4] << 8 | buf[5] << 0;
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index e4d7f2febf00c..05b3974bd9202 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -2338,11 +2338,12 @@ smiapp_sysfs_nvm_read(struct device *dev, struct device_attribute *attr,
+ 		if (rval < 0) {
+ 			if (rval != -EBUSY && rval != -EAGAIN)
+ 				pm_runtime_set_active(&client->dev);
+-			pm_runtime_put(&client->dev);
++			pm_runtime_put_noidle(&client->dev);
+ 			return -ENODEV;
+ 		}
+ 
+ 		if (smiapp_read_nvm(sensor, sensor->nvm)) {
++			pm_runtime_put(&client->dev);
+ 			dev_err(&client->dev, "nvm read failed\n");
+ 			return -ENODEV;
+ 		}
+diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
+index b6dcae1ecc1be..ad344e642ddb7 100644
+--- a/drivers/media/platform/ti-vpe/cal.c
++++ b/drivers/media/platform/ti-vpe/cal.c
+@@ -687,12 +687,13 @@ static void pix_proc_config(struct cal_ctx *ctx)
+ }
+ 
+ static void cal_wr_dma_config(struct cal_ctx *ctx,
+-			      unsigned int width)
++			      unsigned int width, unsigned int height)
+ {
+ 	u32 val;
+ 
+ 	val = reg_read(ctx->dev, CAL_WR_DMA_CTRL(ctx->csi2_port));
+ 	set_field(&val, ctx->csi2_port, CAL_WR_DMA_CTRL_CPORT_MASK);
++	set_field(&val, height, CAL_WR_DMA_CTRL_YSIZE_MASK);
+ 	set_field(&val, CAL_WR_DMA_CTRL_DTAG_PIX_DAT,
+ 		  CAL_WR_DMA_CTRL_DTAG_MASK);
+ 	set_field(&val, CAL_WR_DMA_CTRL_MODE_CONST,
+@@ -1318,7 +1319,8 @@ static int cal_start_streaming(struct vb2_queue *vq, unsigned int count)
+ 	csi2_lane_config(ctx);
+ 	csi2_ctx_config(ctx);
+ 	pix_proc_config(ctx);
+-	cal_wr_dma_config(ctx, ctx->v_fmt.fmt.pix.bytesperline);
++	cal_wr_dma_config(ctx, ctx->v_fmt.fmt.pix.bytesperline,
++			  ctx->v_fmt.fmt.pix.height);
+ 	cal_wr_dma_addr(ctx, addr);
+ 	csi2_ppi_enable(ctx);
+ 
+diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
+index ed9bcaf08d5ec..ddfaabd4c0813 100644
+--- a/drivers/media/usb/go7007/go7007-usb.c
++++ b/drivers/media/usb/go7007/go7007-usb.c
+@@ -1052,6 +1052,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ 	struct go7007_usb *usb;
+ 	const struct go7007_usb_board *board;
+ 	struct usb_device *usbdev = interface_to_usbdev(intf);
++	struct usb_host_endpoint *ep;
+ 	unsigned num_i2c_devs;
+ 	char *name;
+ 	int video_pipe, i, v_urb_len;
+@@ -1147,7 +1148,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ 	if (usb->intr_urb->transfer_buffer == NULL)
+ 		goto allocfail;
+ 
+-	if (go->board_id == GO7007_BOARDID_SENSORAY_2250)
++	ep = usb->usbdev->ep_in[4];
++	if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+ 		usb_fill_bulk_urb(usb->intr_urb, usb->usbdev,
+ 			usb_rcvbulkpipe(usb->usbdev, 4),
+ 			usb->intr_urb->transfer_buffer, 2*sizeof(u16),
+diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
+index 5c8ed2150c8bf..fb687368ac98c 100644
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -32,6 +32,11 @@ int mfd_cell_enable(struct platform_device *pdev)
+ 	const struct mfd_cell *cell = mfd_get_cell(pdev);
+ 	int err = 0;
+ 
++	if (!cell->enable) {
++		dev_dbg(&pdev->dev, "No .enable() call-back registered\n");
++		return 0;
++	}
++
+ 	/* only call enable hook if the cell wasn't previously enabled */
+ 	if (atomic_inc_return(cell->usage_count) == 1)
+ 		err = cell->enable(pdev);
+@@ -49,6 +54,11 @@ int mfd_cell_disable(struct platform_device *pdev)
+ 	const struct mfd_cell *cell = mfd_get_cell(pdev);
+ 	int err = 0;
+ 
++	if (!cell->disable) {
++		dev_dbg(&pdev->dev, "No .disable() call-back registered\n");
++		return 0;
++	}
++
+ 	/* only disable if no other clients are using it */
+ 	if (atomic_dec_return(cell->usage_count) == 0)
+ 		err = cell->disable(pdev);
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 814a04e8fdd77..2be2313f5950a 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -300,7 +300,7 @@ static void mmc_manage_enhanced_area(struct mmc_card *card, u8 *ext_csd)
+ 	}
+ }
+ 
+-static void mmc_part_add(struct mmc_card *card, unsigned int size,
++static void mmc_part_add(struct mmc_card *card, u64 size,
+ 			 unsigned int part_cfg, char *name, int idx, bool ro,
+ 			 int area_type)
+ {
+@@ -316,7 +316,7 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd)
+ {
+ 	int idx;
+ 	u8 hc_erase_grp_sz, hc_wp_grp_sz;
+-	unsigned int part_size;
++	u64 part_size;
+ 
+ 	/*
+ 	 * General purpose partition feature support --
+@@ -346,8 +346,7 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd)
+ 				(ext_csd[EXT_CSD_GP_SIZE_MULT + idx * 3 + 1]
+ 				<< 8) +
+ 				ext_csd[EXT_CSD_GP_SIZE_MULT + idx * 3];
+-			part_size *= (size_t)(hc_erase_grp_sz *
+-				hc_wp_grp_sz);
++			part_size *= (hc_erase_grp_sz * hc_wp_grp_sz);
+ 			mmc_part_add(card, part_size << 19,
+ 				EXT_CSD_PART_CONFIG_ACC_GP0 + idx,
+ 				"gp%d", idx, false,
+@@ -365,7 +364,7 @@ static void mmc_manage_gp_partitions(struct mmc_card *card, u8 *ext_csd)
+ static int mmc_decode_ext_csd(struct mmc_card *card, u8 *ext_csd)
+ {
+ 	int err = 0, idx;
+-	unsigned int part_size;
++	u64 part_size;
+ 	struct device_node *np;
+ 	bool broken_hpi = false;
+ 
+diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
+index 1f0d83086cb09..870d1f1331b18 100644
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -726,7 +726,6 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)
+ 	kfree(mtd->eraseregions);
+ 	kfree(mtd);
+ 	kfree(cfi->cmdset_priv);
+-	kfree(cfi->cfiq);
+ 	return NULL;
+ }
+ 
+diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c
+index fbd5affc0acfe..04fd845de05fb 100644
+--- a/drivers/mtd/cmdlinepart.c
++++ b/drivers/mtd/cmdlinepart.c
+@@ -228,12 +228,29 @@ static int mtdpart_setup_real(char *s)
+ 		struct cmdline_mtd_partition *this_mtd;
+ 		struct mtd_partition *parts;
+ 		int mtd_id_len, num_parts;
+-		char *p, *mtd_id;
++		char *p, *mtd_id, *semicol;
++
++		/*
++		 * Replace the first ';' by a NULL char so strrchr can work
++		 * properly.
++		 */
++		semicol = strchr(s, ';');
++		if (semicol)
++			*semicol = '\0';
+ 
+ 		mtd_id = s;
+ 
+-		/* fetch <mtd-id> */
+-		p = strchr(s, ':');
++		/*
++		 * fetch <mtd-id>. We use strrchr to ignore all ':' that could
++		 * be present in the MTD name, only the last one is interpreted
++		 * as an <mtd-id>/<part-definition> separator.
++		 */
++		p = strrchr(s, ':');
++
++		/* Restore the ';' now. */
++		if (semicol)
++			*semicol = ';';
++
+ 		if (!p) {
+ 			pr_err("no mtd-id\n");
+ 			return -EINVAL;
+diff --git a/drivers/mtd/nand/omap_elm.c b/drivers/mtd/nand/omap_elm.c
+index a3f32f939cc17..6736777a41567 100644
+--- a/drivers/mtd/nand/omap_elm.c
++++ b/drivers/mtd/nand/omap_elm.c
+@@ -421,6 +421,7 @@ static int elm_probe(struct platform_device *pdev)
+ 	pm_runtime_enable(&pdev->dev);
+ 	if (pm_runtime_get_sync(&pdev->dev) < 0) {
+ 		ret = -EINVAL;
++		pm_runtime_put_sync(&pdev->dev);
+ 		pm_runtime_disable(&pdev->dev);
+ 		dev_err(&pdev->dev, "can't enable clock\n");
+ 		return ret;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index a38433cb9015d..cc2ecbbfd4bde 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1264,9 +1264,12 @@ static int bnxt_set_pauseparam(struct net_device *dev,
+ 	if (!BNXT_SINGLE_PF(bp))
+ 		return -EOPNOTSUPP;
+ 
++	mutex_lock(&bp->link_lock);
+ 	if (epause->autoneg) {
+-		if (!(link_info->autoneg & BNXT_AUTONEG_SPEED))
+-			return -EINVAL;
++		if (!(link_info->autoneg & BNXT_AUTONEG_SPEED)) {
++			rc = -EINVAL;
++			goto pause_exit;
++		}
+ 
+ 		link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL;
+ 		if (bp->hwrm_spec_code >= 0x10201)
+@@ -1287,11 +1290,11 @@ static int bnxt_set_pauseparam(struct net_device *dev,
+ 	if (epause->tx_pause)
+ 		link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX;
+ 
+-	if (netif_running(dev)) {
+-		mutex_lock(&bp->link_lock);
++	if (netif_running(dev))
+ 		rc = bnxt_hwrm_set_pause(bp);
+-		mutex_unlock(&bp->link_lock);
+-	}
++
++pause_exit:
++	mutex_unlock(&bp->link_lock);
+ 	return rc;
+ }
+ 
+@@ -1977,8 +1980,7 @@ static int bnxt_set_eee(struct net_device *dev, struct ethtool_eee *edata)
+ 	struct bnxt *bp = netdev_priv(dev);
+ 	struct ethtool_eee *eee = &bp->eee;
+ 	struct bnxt_link_info *link_info = &bp->link_info;
+-	u32 advertising =
+-		 _bnxt_fw_to_ethtool_adv_spds(link_info->advertising, 0);
++	u32 advertising;
+ 	int rc = 0;
+ 
+ 	if (!BNXT_SINGLE_PF(bp))
+@@ -1987,19 +1989,23 @@ static int bnxt_set_eee(struct net_device *dev, struct ethtool_eee *edata)
+ 	if (!(bp->flags & BNXT_FLAG_EEE_CAP))
+ 		return -EOPNOTSUPP;
+ 
++	mutex_lock(&bp->link_lock);
++	advertising = _bnxt_fw_to_ethtool_adv_spds(link_info->advertising, 0);
+ 	if (!edata->eee_enabled)
+ 		goto eee_ok;
+ 
+ 	if (!(link_info->autoneg & BNXT_AUTONEG_SPEED)) {
+ 		netdev_warn(dev, "EEE requires autoneg\n");
+-		return -EINVAL;
++		rc = -EINVAL;
++		goto eee_exit;
+ 	}
+ 	if (edata->tx_lpi_enabled) {
+ 		if (bp->lpi_tmr_hi && (edata->tx_lpi_timer > bp->lpi_tmr_hi ||
+ 				       edata->tx_lpi_timer < bp->lpi_tmr_lo)) {
+ 			netdev_warn(dev, "Valid LPI timer range is %d and %d microsecs\n",
+ 				    bp->lpi_tmr_lo, bp->lpi_tmr_hi);
+-			return -EINVAL;
++			rc = -EINVAL;
++			goto eee_exit;
+ 		} else if (!bp->lpi_tmr_hi) {
+ 			edata->tx_lpi_timer = eee->tx_lpi_timer;
+ 		}
+@@ -2009,7 +2015,8 @@ static int bnxt_set_eee(struct net_device *dev, struct ethtool_eee *edata)
+ 	} else if (edata->advertised & ~advertising) {
+ 		netdev_warn(dev, "EEE advertised %x must be a subset of autoneg advertised speeds %x\n",
+ 			    edata->advertised, advertising);
+-		return -EINVAL;
++		rc = -EINVAL;
++		goto eee_exit;
+ 	}
+ 
+ 	eee->advertised = edata->advertised;
+@@ -2021,6 +2028,8 @@ eee_ok:
+ 	if (netif_running(dev))
+ 		rc = bnxt_hwrm_set_link_setting(bp, false, true);
+ 
++eee_exit:
++	mutex_unlock(&bp->link_lock);
+ 	return rc;
+ }
+ 
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index 175681aa52607..8cc0e48738152 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -567,8 +567,13 @@ void e1000_reinit_locked(struct e1000_adapter *adapter)
+ 	WARN_ON(in_interrupt());
+ 	while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
+ 		msleep(1);
+-	e1000_down(adapter);
+-	e1000_up(adapter);
++
++	/* only run the task if not already down */
++	if (!test_bit(__E1000_DOWN, &adapter->flags)) {
++		e1000_down(adapter);
++		e1000_up(adapter);
++	}
++
+ 	clear_bit(__E1000_RESETTING, &adapter->flags);
+ }
+ 
+@@ -1458,10 +1463,15 @@ int e1000_close(struct net_device *netdev)
+ 	struct e1000_hw *hw = &adapter->hw;
+ 	int count = E1000_CHECK_RESET_COUNT;
+ 
+-	while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
++	while (test_and_set_bit(__E1000_RESETTING, &adapter->flags) && count--)
+ 		usleep_range(10000, 20000);
+ 
+-	WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
++	WARN_ON(count < 0);
++
++	/* signal that we're down so that the reset task will no longer run */
++	set_bit(__E1000_DOWN, &adapter->flags);
++	clear_bit(__E1000_RESETTING, &adapter->flags);
++
+ 	e1000_down(adapter);
+ 	e1000_power_down_phy(adapter);
+ 	e1000_free_irq(adapter);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+index 65a53d409e773..bc9eec1bcbf18 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -96,6 +96,7 @@ static int qed_sp_vf_start(struct qed_hwfn *p_hwfn, struct qed_vf_info *p_vf)
+ 		p_ramrod->personality = PERSONALITY_ETH;
+ 		break;
+ 	case QED_PCI_ETH_ROCE:
++	case QED_PCI_ETH_IWARP:
+ 		p_ramrod->personality = PERSONALITY_RDMA_AND_ETH;
+ 		break;
+ 	default:
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 3c9f8770f7e78..f48006c22a8a6 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -716,7 +716,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb,
+ 				       struct net_device *dev,
+ 				       struct geneve_sock *gs4,
+ 				       struct flowi4 *fl4,
+-				       const struct ip_tunnel_info *info)
++				       const struct ip_tunnel_info *info,
++				       __be16 dport, __be16 sport)
+ {
+ 	bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
+ 	struct geneve_dev *geneve = netdev_priv(dev);
+@@ -732,6 +733,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb,
+ 	fl4->flowi4_proto = IPPROTO_UDP;
+ 	fl4->daddr = info->key.u.ipv4.dst;
+ 	fl4->saddr = info->key.u.ipv4.src;
++	fl4->fl4_dport = dport;
++	fl4->fl4_sport = sport;
+ 
+ 	tos = info->key.tos;
+ 	if ((tos == 1) && !geneve->collect_md) {
+@@ -766,7 +769,8 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,
+ 					   struct net_device *dev,
+ 					   struct geneve_sock *gs6,
+ 					   struct flowi6 *fl6,
+-					   const struct ip_tunnel_info *info)
++					   const struct ip_tunnel_info *info,
++					   __be16 dport, __be16 sport)
+ {
+ 	bool use_cache = ip_tunnel_dst_cache_usable(skb, info);
+ 	struct geneve_dev *geneve = netdev_priv(dev);
+@@ -782,6 +786,9 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb,
+ 	fl6->flowi6_proto = IPPROTO_UDP;
+ 	fl6->daddr = info->key.u.ipv6.dst;
+ 	fl6->saddr = info->key.u.ipv6.src;
++	fl6->fl6_dport = dport;
++	fl6->fl6_sport = sport;
++
+ 	prio = info->key.tos;
+ 	if ((prio == 1) && !geneve->collect_md) {
+ 		prio = ip_tunnel_get_dsfield(ip_hdr(skb), skb);
+@@ -828,7 +835,9 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ 	__be16 df;
+ 	int err;
+ 
+-	rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info);
++	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
++	rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info,
++			      geneve->info.key.tp_dst, sport);
+ 	if (IS_ERR(rt))
+ 		return PTR_ERR(rt);
+ 
+@@ -839,7 +848,6 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ 		skb_dst_update_pmtu(skb, mtu);
+ 	}
+ 
+-	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+ 	if (geneve->collect_md) {
+ 		tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
+ 		ttl = key->ttl;
+@@ -874,7 +882,9 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ 	__be16 sport;
+ 	int err;
+ 
+-	dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info);
++	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
++	dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info,
++				geneve->info.key.tp_dst, sport);
+ 	if (IS_ERR(dst))
+ 		return PTR_ERR(dst);
+ 
+@@ -885,7 +895,6 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
+ 		skb_dst_update_pmtu(skb, mtu);
+ 	}
+ 
+-	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
+ 	if (geneve->collect_md) {
+ 		prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
+ 		ttl = key->ttl;
+@@ -963,13 +972,18 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
+ {
+ 	struct ip_tunnel_info *info = skb_tunnel_info(skb);
+ 	struct geneve_dev *geneve = netdev_priv(dev);
++	__be16 sport;
+ 
+ 	if (ip_tunnel_info_af(info) == AF_INET) {
+ 		struct rtable *rt;
+ 		struct flowi4 fl4;
++
+ 		struct geneve_sock *gs4 = rcu_dereference(geneve->sock4);
++		sport = udp_flow_src_port(geneve->net, skb,
++					  1, USHRT_MAX, true);
+ 
+-		rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info);
++		rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info,
++				      geneve->info.key.tp_dst, sport);
+ 		if (IS_ERR(rt))
+ 			return PTR_ERR(rt);
+ 
+@@ -979,9 +993,13 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
+ 	} else if (ip_tunnel_info_af(info) == AF_INET6) {
+ 		struct dst_entry *dst;
+ 		struct flowi6 fl6;
++
+ 		struct geneve_sock *gs6 = rcu_dereference(geneve->sock6);
++		sport = udp_flow_src_port(geneve->net, skb,
++					  1, USHRT_MAX, true);
+ 
+-		dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info);
++		dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info,
++					geneve->info.key.tp_dst, sport);
+ 		if (IS_ERR(dst))
+ 			return PTR_ERR(dst);
+ 
+@@ -992,8 +1010,7 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
+ 		return -EINVAL;
+ 	}
+ 
+-	info->key.tp_src = udp_flow_src_port(geneve->net, skb,
+-					     1, USHRT_MAX, true);
++	info->key.tp_src = sport;
+ 	info->key.tp_dst = geneve->info.key.tp_dst;
+ 	return 0;
+ }
+diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
+index 46b42de13d76f..3510eb26ccd55 100644
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -834,7 +834,9 @@ static int adf7242_rx(struct adf7242_local *lp)
+ 	int ret;
+ 	u8 lqi, len_u8, *data;
+ 
+-	adf7242_read_reg(lp, 0, &len_u8);
++	ret = adf7242_read_reg(lp, 0, &len_u8);
++	if (ret)
++		return ret;
+ 
+ 	len = len_u8;
+ 
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 3a58962babd41..368369469e321 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -2924,6 +2924,7 @@ static int ca8210_dev_com_init(struct ca8210_priv *priv)
+ 	);
+ 	if (!priv->irq_workqueue) {
+ 		dev_crit(&priv->spi->dev, "alloc of irq_workqueue failed!\n");
++		destroy_workqueue(priv->mlme_workqueue);
+ 		return -ENOMEM;
+ 	}
+ 
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 27f1f0b5b8f67..b51bca051c475 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1121,7 +1121,8 @@ void phy_detach(struct phy_device *phydev)
+ 
+ 	phy_led_triggers_unregister(phydev);
+ 
+-	module_put(phydev->mdio.dev.driver->owner);
++	if (phydev->mdio.dev.driver)
++		module_put(phydev->mdio.dev.driver->owner);
+ 
+ 	/* If the device had no specific driver before (i.e. - it
+ 	 * was using the generic driver), we unbind the device
+diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
+index f3c1d52459788..d42b861cc8965 100644
+--- a/drivers/net/wan/hdlc_ppp.c
++++ b/drivers/net/wan/hdlc_ppp.c
+@@ -386,11 +386,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ 	}
+ 
+ 	for (opt = data; len; len -= opt[1], opt += opt[1]) {
+-		if (len < 2 || len < opt[1]) {
+-			dev->stats.rx_errors++;
+-			kfree(out);
+-			return; /* bad packet, drop silently */
+-		}
++		if (len < 2 || opt[1] < 2 || len < opt[1])
++			goto err_out;
+ 
+ 		if (pid == PID_LCP)
+ 			switch (opt[0]) {
+@@ -398,6 +395,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ 				continue; /* MRU always OK and > 1500 bytes? */
+ 
+ 			case LCP_OPTION_ACCM: /* async control character map */
++				if (opt[1] < sizeof(valid_accm))
++					goto err_out;
+ 				if (!memcmp(opt, valid_accm,
+ 					    sizeof(valid_accm)))
+ 					continue;
+@@ -409,6 +408,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ 				}
+ 				break;
+ 			case LCP_OPTION_MAGIC:
++				if (len < 6)
++					goto err_out;
+ 				if (opt[1] != 6 || (!opt[2] && !opt[3] &&
+ 						    !opt[4] && !opt[5]))
+ 					break; /* reject invalid magic number */
+@@ -427,6 +428,11 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ 		ppp_cp_event(dev, pid, RCR_GOOD, CP_CONF_ACK, id, req_len, data);
+ 
+ 	kfree(out);
++	return;
++
++err_out:
++	dev->stats.rx_errors++;
++	kfree(out);
+ }
+ 
+ static int ppp_rx(struct sk_buff *skb)
+diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
+index ad4a1efc57c97..e1a1d27427cc9 100644
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -1771,6 +1771,8 @@ static const struct usb_device_id ar5523_id_table[] = {
+ 	AR5523_DEVICE_UX(0x0846, 0x4300),	/* Netgear / WG111U */
+ 	AR5523_DEVICE_UG(0x0846, 0x4250),	/* Netgear / WG111T */
+ 	AR5523_DEVICE_UG(0x0846, 0x5f00),	/* Netgear / WPN111 */
++	AR5523_DEVICE_UG(0x083a, 0x4506),	/* SMC / EZ Connect
++						   SMCWUSBT-G2 */
+ 	AR5523_DEVICE_UG(0x157e, 0x3006),	/* Umedia / AR5523_1 */
+ 	AR5523_DEVICE_UX(0x157e, 0x3205),	/* Umedia / AR5523_2 */
+ 	AR5523_DEVICE_UG(0x157e, 0x3006),	/* Umedia / TEW444UBEU */
+diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
+index f49b21b137c13..fef313099e08a 100644
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -1564,23 +1564,33 @@ static int ath10k_sdio_hif_diag_read(struct ath10k *ar, u32 address, void *buf,
+ 				     size_t buf_len)
+ {
+ 	int ret;
++	void *mem;
++
++	mem = kzalloc(buf_len, GFP_KERNEL);
++	if (!mem)
++		return -ENOMEM;
+ 
+ 	/* set window register to start read cycle */
+ 	ret = ath10k_sdio_write32(ar, MBOX_WINDOW_READ_ADDR_ADDRESS, address);
+ 	if (ret) {
+ 		ath10k_warn(ar, "failed to set mbox window read address: %d", ret);
+-		return ret;
++		goto out;
+ 	}
+ 
+ 	/* read the data */
+-	ret = ath10k_sdio_read(ar, MBOX_WINDOW_DATA_ADDRESS, buf, buf_len);
++	ret = ath10k_sdio_read(ar, MBOX_WINDOW_DATA_ADDRESS, mem, buf_len);
+ 	if (ret) {
+ 		ath10k_warn(ar, "failed to read from mbox window data address: %d\n",
+ 			    ret);
+-		return ret;
++		goto out;
+ 	}
+ 
+-	return 0;
++	memcpy(buf, mem, buf_len);
++
++out:
++	kfree(mem);
++
++	return ret;
+ }
+ 
+ static int ath10k_sdio_hif_diag_read32(struct ath10k *ar, u32 address,
+diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
+index 342555ebafd79..1d86d29b64ccc 100644
+--- a/drivers/net/wireless/marvell/mwifiex/fw.h
++++ b/drivers/net/wireless/marvell/mwifiex/fw.h
+@@ -938,7 +938,7 @@ struct mwifiex_tkip_param {
+ struct mwifiex_aes_param {
+ 	u8 pn[WPA_PN_SIZE];
+ 	__le16 key_len;
+-	u8 key[WLAN_KEY_LEN_CCMP];
++	u8 key[WLAN_KEY_LEN_CCMP_256];
+ } __packed;
+ 
+ struct mwifiex_wapi_param {
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+index 19ce279df24d9..1aeb8cf6dff97 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+@@ -624,7 +624,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
+ 	key_v2 = &resp->params.key_material_v2;
+ 
+ 	len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len);
+-	if (len > WLAN_KEY_LEN_CCMP)
++	if (len > sizeof(key_v2->key_param_set.key_params.aes.key))
+ 		return -EINVAL;
+ 
+ 	if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) {
+@@ -640,7 +640,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
+ 		return 0;
+ 
+ 	memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0,
+-	       WLAN_KEY_LEN_CCMP);
++	       sizeof(key_v2->key_param_set.key_params.aes.key));
+ 	priv->aes_key_v2.key_param_set.key_params.aes.key_len =
+ 				cpu_to_le16(len);
+ 	memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c
+index 2526971f99299..3eeaf57e6d939 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c
+@@ -102,6 +102,8 @@
+ #define QSERDES_COM_CORECLK_DIV_MODE1			0x1bc
+ 
+ /* QMP PHY TX registers */
++#define QSERDES_TX_EMP_POST1_LVL			0x018
++#define QSERDES_TX_SLEW_CNTL				0x040
+ #define QSERDES_TX_RES_CODE_LANE_OFFSET			0x054
+ #define QSERDES_TX_DEBUG_BUS_SEL			0x064
+ #define QSERDES_TX_HIGHZ_TRANSCEIVEREN_BIAS_DRVR_EN	0x068
+@@ -394,8 +396,8 @@ static const struct qmp_phy_init_tbl ipq8074_pcie_serdes_tbl[] = {
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_BG_TRIM, 0xf),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_EN, 0x1),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_MAP, 0x0),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER1, 0x1f),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER2, 0x3f),
++	QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER1, 0xff),
++	QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER2, 0x1f),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_CMN_CONFIG, 0x6),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_IVCO, 0xf),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_HSCLK_SEL, 0x0),
+@@ -421,7 +423,6 @@ static const struct qmp_phy_init_tbl ipq8074_pcie_serdes_tbl[] = {
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN1_MODE0, 0x0),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN0_MODE0, 0x80),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CTRL_BY_PSM, 0x1),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_CTRL, 0xa),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_EN_CENTER, 0x1),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER1, 0x31),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER2, 0x1),
+@@ -430,7 +431,6 @@ static const struct qmp_phy_init_tbl ipq8074_pcie_serdes_tbl[] = {
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE1, 0x2f),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE2, 0x19),
+ 	QMP_PHY_INIT_CFG(QSERDES_COM_CLK_EP_DIV, 0x19),
+-	QMP_PHY_INIT_CFG(QSERDES_RX_SIGDET_CNTRL, 0x7),
+ };
+ 
+ static const struct qmp_phy_init_tbl ipq8074_pcie_tx_tbl[] = {
+@@ -438,6 +438,8 @@ static const struct qmp_phy_init_tbl ipq8074_pcie_tx_tbl[] = {
+ 	QMP_PHY_INIT_CFG(QSERDES_TX_LANE_MODE, 0x6),
+ 	QMP_PHY_INIT_CFG(QSERDES_TX_RES_CODE_LANE_OFFSET, 0x2),
+ 	QMP_PHY_INIT_CFG(QSERDES_TX_RCV_DETECT_LVL_2, 0x12),
++	QMP_PHY_INIT_CFG(QSERDES_TX_EMP_POST1_LVL, 0x36),
++	QMP_PHY_INIT_CFG(QSERDES_TX_SLEW_CNTL, 0x0a),
+ };
+ 
+ static const struct qmp_phy_init_tbl ipq8074_pcie_rx_tbl[] = {
+@@ -448,7 +450,6 @@ static const struct qmp_phy_init_tbl ipq8074_pcie_rx_tbl[] = {
+ 	QMP_PHY_INIT_CFG(QSERDES_RX_RX_EQU_ADAPTOR_CNTRL4, 0xdb),
+ 	QMP_PHY_INIT_CFG(QSERDES_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x4b),
+ 	QMP_PHY_INIT_CFG(QSERDES_RX_UCDR_SO_GAIN, 0x4),
+-	QMP_PHY_INIT_CFG(QSERDES_RX_UCDR_SO_GAIN_HALF, 0x4),
+ };
+ 
+ static const struct qmp_phy_init_tbl ipq8074_pcie_pcs_tbl[] = {
+@@ -665,6 +666,9 @@ static const struct qmp_phy_cfg msm8996_usb3phy_cfg = {
+ 	.mask_pcs_ready		= PHYSTATUS,
+ };
+ 
++static const char * const ipq8074_pciephy_clk_l[] = {
++	"aux", "cfg_ahb",
++};
+ /* list of resets */
+ static const char * const ipq8074_pciephy_reset_l[] = {
+ 	"phy", "common",
+@@ -682,8 +686,8 @@ static const struct qmp_phy_cfg ipq8074_pciephy_cfg = {
+ 	.rx_tbl_num		= ARRAY_SIZE(ipq8074_pcie_rx_tbl),
+ 	.pcs_tbl		= ipq8074_pcie_pcs_tbl,
+ 	.pcs_tbl_num		= ARRAY_SIZE(ipq8074_pcie_pcs_tbl),
+-	.clk_list		= NULL,
+-	.num_clks		= 0,
++	.clk_list		= ipq8074_pciephy_clk_l,
++	.num_clks		= ARRAY_SIZE(ipq8074_pciephy_clk_l),
+ 	.reset_list		= ipq8074_pciephy_reset_l,
+ 	.num_resets		= ARRAY_SIZE(ipq8074_pciephy_reset_l),
+ 	.vreg_list		= NULL,
+diff --git a/drivers/phy/samsung/phy-s5pv210-usb2.c b/drivers/phy/samsung/phy-s5pv210-usb2.c
+index f6f72339bbc32..bb7fdf491c1c2 100644
+--- a/drivers/phy/samsung/phy-s5pv210-usb2.c
++++ b/drivers/phy/samsung/phy-s5pv210-usb2.c
+@@ -142,6 +142,10 @@ static void s5pv210_phy_pwr(struct samsung_usb2_phy_instance *inst, bool on)
+ 		udelay(10);
+ 		rst &= ~rstbits;
+ 		writel(rst, drv->reg_phy + S5PV210_UPHYRST);
++		/* The following delay is necessary for the reset sequence to be
++		 * completed
++		 */
++		udelay(80);
+ 	} else {
+ 		pwr = readl(drv->reg_phy + S5PV210_UPHYPWR);
+ 		pwr |= phypwr;
+diff --git a/drivers/power/supply/max17040_battery.c b/drivers/power/supply/max17040_battery.c
+index 33c40f79d23d5..2c35c13ad546f 100644
+--- a/drivers/power/supply/max17040_battery.c
++++ b/drivers/power/supply/max17040_battery.c
+@@ -109,7 +109,7 @@ static void max17040_get_vcell(struct i2c_client *client)
+ 
+ 	vcell = max17040_read_reg(client, MAX17040_VCELL);
+ 
+-	chip->vcell = vcell;
++	chip->vcell = (vcell >> 4) * 1250;
+ }
+ 
+ static void max17040_get_soc(struct i2c_client *client)
+diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
+index f15f6d1e1070a..f207f8725993c 100644
+--- a/drivers/rapidio/devices/rio_mport_cdev.c
++++ b/drivers/rapidio/devices/rio_mport_cdev.c
+@@ -2464,13 +2464,6 @@ static struct mport_dev *mport_cdev_add(struct rio_mport *mport)
+ 	cdev_init(&md->cdev, &mport_fops);
+ 	md->cdev.owner = THIS_MODULE;
+ 
+-	ret = cdev_device_add(&md->cdev, &md->dev);
+-	if (ret) {
+-		rmcd_error("Failed to register mport %d (err=%d)",
+-		       mport->id, ret);
+-		goto err_cdev;
+-	}
+-
+ 	INIT_LIST_HEAD(&md->doorbells);
+ 	spin_lock_init(&md->db_lock);
+ 	INIT_LIST_HEAD(&md->portwrites);
+@@ -2490,6 +2483,13 @@ static struct mport_dev *mport_cdev_add(struct rio_mport *mport)
+ #else
+ 	md->properties.transfer_mode |= RIO_TRANSFER_MODE_TRANSFER;
+ #endif
++
++	ret = cdev_device_add(&md->cdev, &md->dev);
++	if (ret) {
++		rmcd_error("Failed to register mport %d (err=%d)",
++		       mport->id, ret);
++		goto err_cdev;
++	}
+ 	ret = rio_query_mport(mport, &attr);
+ 	if (!ret) {
+ 		md->properties.flags = attr.flags;
+diff --git a/drivers/rtc/rtc-ds1374.c b/drivers/rtc/rtc-ds1374.c
+index 38a2e9e684df4..77a106e90124b 100644
+--- a/drivers/rtc/rtc-ds1374.c
++++ b/drivers/rtc/rtc-ds1374.c
+@@ -620,6 +620,10 @@ static int ds1374_probe(struct i2c_client *client,
+ 	if (!ds1374)
+ 		return -ENOMEM;
+ 
++	ds1374->rtc = devm_rtc_allocate_device(&client->dev);
++	if (IS_ERR(ds1374->rtc))
++		return PTR_ERR(ds1374->rtc);
++
+ 	ds1374->client = client;
+ 	i2c_set_clientdata(client, ds1374);
+ 
+@@ -641,12 +645,11 @@ static int ds1374_probe(struct i2c_client *client,
+ 		device_set_wakeup_capable(&client->dev, 1);
+ 	}
+ 
+-	ds1374->rtc = devm_rtc_device_register(&client->dev, client->name,
+-						&ds1374_rtc_ops, THIS_MODULE);
+-	if (IS_ERR(ds1374->rtc)) {
+-		dev_err(&client->dev, "unable to register the class device\n");
+-		return PTR_ERR(ds1374->rtc);
+-	}
++	ds1374->rtc->ops = &ds1374_rtc_ops;
++
++	ret = rtc_register_device(ds1374->rtc);
++	if (ret)
++		return ret;
+ 
+ #ifdef CONFIG_RTC_DRV_DS1374_WDT
+ 	save_client = client;
+diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
+index 6168ccdb389c3..91a569c10dea0 100644
+--- a/drivers/s390/block/dasd_fba.c
++++ b/drivers/s390/block/dasd_fba.c
+@@ -39,6 +39,7 @@
+ MODULE_LICENSE("GPL");
+ 
+ static struct dasd_discipline dasd_fba_discipline;
++static void *dasd_fba_zero_page;
+ 
+ struct dasd_fba_private {
+ 	struct dasd_fba_characteristics rdc_data;
+@@ -269,7 +270,7 @@ static void ccw_write_zero(struct ccw1 *ccw, int count)
+ 	ccw->cmd_code = DASD_FBA_CCW_WRITE;
+ 	ccw->flags |= CCW_FLAG_SLI;
+ 	ccw->count = count;
+-	ccw->cda = (__u32) (addr_t) page_to_phys(ZERO_PAGE(0));
++	ccw->cda = (__u32) (addr_t) dasd_fba_zero_page;
+ }
+ 
+ /*
+@@ -808,6 +809,11 @@ dasd_fba_init(void)
+ 	int ret;
+ 
+ 	ASCEBC(dasd_fba_discipline.ebcname, 4);
++
++	dasd_fba_zero_page = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
++	if (!dasd_fba_zero_page)
++		return -ENOMEM;
++
+ 	ret = ccw_driver_register(&dasd_fba_driver);
+ 	if (!ret)
+ 		wait_for_device_probe();
+@@ -819,6 +825,7 @@ static void __exit
+ dasd_fba_cleanup(void)
+ {
+ 	ccw_driver_unregister(&dasd_fba_driver);
++	free_page((unsigned long)dasd_fba_zero_page);
+ }
+ 
+ module_init(dasd_fba_init);
+diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
+index 7173ae53c5260..ba11313568810 100644
+--- a/drivers/scsi/aacraid/aachba.c
++++ b/drivers/scsi/aacraid/aachba.c
+@@ -2322,13 +2322,13 @@ static int aac_read(struct scsi_cmnd * scsicmd)
+ 		scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+ 			SAM_STAT_CHECK_CONDITION;
+ 		set_sense(&dev->fsa_dev[cid].sense_data,
+-			  HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE,
++			  ILLEGAL_REQUEST, SENCODE_LBA_OUT_OF_RANGE,
+ 			  ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0);
+ 		memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
+ 		       min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data),
+ 			     SCSI_SENSE_BUFFERSIZE));
+ 		scsicmd->scsi_done(scsicmd);
+-		return 1;
++		return 0;
+ 	}
+ 
+ 	dprintk((KERN_DEBUG "aac_read[cpu %d]: lba = %llu, t = %ld.\n",
+@@ -2414,13 +2414,13 @@ static int aac_write(struct scsi_cmnd * scsicmd)
+ 		scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+ 			SAM_STAT_CHECK_CONDITION;
+ 		set_sense(&dev->fsa_dev[cid].sense_data,
+-			  HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE,
++			  ILLEGAL_REQUEST, SENCODE_LBA_OUT_OF_RANGE,
+ 			  ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0);
+ 		memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
+ 		       min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data),
+ 			     SCSI_SENSE_BUFFERSIZE));
+ 		scsicmd->scsi_done(scsicmd);
+-		return 1;
++		return 0;
+ 	}
+ 
+ 	dprintk((KERN_DEBUG "aac_write[cpu %d]: lba = %llu, t = %ld.\n",
+diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
+index a284527999c55..65a5cd6a5f961 100644
+--- a/drivers/scsi/aacraid/commsup.c
++++ b/drivers/scsi/aacraid/commsup.c
+@@ -771,7 +771,7 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback,
+ 		hbacmd->request_id =
+ 			cpu_to_le32((((u32)(fibptr - dev->fibs)) << 2) + 1);
+ 		fibptr->flags |= FIB_CONTEXT_FLAG_SCSI_CMD;
+-	} else if (command != HBA_IU_TYPE_SCSI_TM_REQ)
++	} else
+ 		return -EINVAL;
+ 
+ 
+diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
+index 053a31c5485f3..e0e728d0dd5e7 100644
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -736,7 +736,11 @@ static int aac_eh_abort(struct scsi_cmnd* cmd)
+ 		status = aac_hba_send(HBA_IU_TYPE_SCSI_TM_REQ, fib,
+ 				  (fib_callback) aac_hba_callback,
+ 				  (void *) cmd);
+-
++		if (status != -EINPROGRESS) {
++			aac_fib_complete(fib);
++			aac_fib_free(fib);
++			return ret;
++		}
+ 		/* Wait up to 15 secs for completion */
+ 		for (count = 0; count < 15; ++count) {
+ 			if (cmd->SCp.sent_command) {
+@@ -915,11 +919,11 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
+ 
+ 	info = &aac->hba_map[bus][cid];
+ 
+-	if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+-	    info->reset_state > 0)
++	if (!(info->devtype == AAC_DEVTYPE_NATIVE_RAW &&
++	 !(info->reset_state > 0)))
+ 		return FAILED;
+ 
+-	pr_err("%s: Host adapter reset request. SCSI hang ?\n",
++	pr_err("%s: Host device reset request. SCSI hang ?\n",
+ 	       AAC_DRIVERNAME);
+ 
+ 	fib = aac_fib_alloc(aac);
+@@ -934,7 +938,12 @@ static int aac_eh_dev_reset(struct scsi_cmnd *cmd)
+ 	status = aac_hba_send(command, fib,
+ 			      (fib_callback) aac_tmf_callback,
+ 			      (void *) info);
+-
++	if (status != -EINPROGRESS) {
++		info->reset_state = 0;
++		aac_fib_complete(fib);
++		aac_fib_free(fib);
++		return ret;
++	}
+ 	/* Wait up to 15 seconds for completion */
+ 	for (count = 0; count < 15; ++count) {
+ 		if (info->reset_state == 0) {
+@@ -973,11 +982,11 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
+ 
+ 	info = &aac->hba_map[bus][cid];
+ 
+-	if (info->devtype != AAC_DEVTYPE_NATIVE_RAW &&
+-	    info->reset_state > 0)
++	if (!(info->devtype == AAC_DEVTYPE_NATIVE_RAW &&
++	 !(info->reset_state > 0)))
+ 		return FAILED;
+ 
+-	pr_err("%s: Host adapter reset request. SCSI hang ?\n",
++	pr_err("%s: Host target reset request. SCSI hang ?\n",
+ 	       AAC_DRIVERNAME);
+ 
+ 	fib = aac_fib_alloc(aac);
+@@ -994,6 +1003,13 @@ static int aac_eh_target_reset(struct scsi_cmnd *cmd)
+ 			      (fib_callback) aac_tmf_callback,
+ 			      (void *) info);
+ 
++	if (status != -EINPROGRESS) {
++		info->reset_state = 0;
++		aac_fib_complete(fib);
++		aac_fib_free(fib);
++		return ret;
++	}
++
+ 	/* Wait up to 15 seconds for completion */
+ 	for (count = 0; count < 15; ++count) {
+ 		if (info->reset_state <= 0) {
+@@ -1046,7 +1062,7 @@ static int aac_eh_bus_reset(struct scsi_cmnd* cmd)
+ 		}
+ 	}
+ 
+-	pr_err("%s: Host adapter reset request. SCSI hang ?\n", AAC_DRIVERNAME);
++	pr_err("%s: Host bus reset request. SCSI hang ?\n", AAC_DRIVERNAME);
+ 
+ 	/*
+ 	 * Check the health of the controller
+diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
+index d79ac0b24f5af..04c25ca2be45f 100644
+--- a/drivers/scsi/fnic/fnic_scsi.c
++++ b/drivers/scsi/fnic/fnic_scsi.c
+@@ -1034,7 +1034,8 @@ static void fnic_fcpio_icmnd_cmpl_handler(struct fnic *fnic,
+ 		atomic64_inc(&fnic_stats->io_stats.io_completions);
+ 
+ 
+-	io_duration_time = jiffies_to_msecs(jiffies) - jiffies_to_msecs(io_req->start_time);
++	io_duration_time = jiffies_to_msecs(jiffies) -
++						jiffies_to_msecs(start_time);
+ 
+ 	if(io_duration_time <= 10)
+ 		atomic64_inc(&fnic_stats->io_stats.io_btw_0_to_10_msec);
+diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
+index 0e964ce75406b..669cf3553a77d 100644
+--- a/drivers/scsi/libfc/fc_rport.c
++++ b/drivers/scsi/libfc/fc_rport.c
+@@ -145,8 +145,10 @@ struct fc_rport_priv *fc_rport_create(struct fc_lport *lport, u32 port_id)
+ 	size_t rport_priv_size = sizeof(*rdata);
+ 
+ 	rdata = fc_rport_lookup(lport, port_id);
+-	if (rdata)
++	if (rdata) {
++		kref_put(&rdata->kref, fc_rport_destroy);
+ 		return rdata;
++	}
+ 
+ 	if (lport->rport_priv_size > 0)
+ 		rport_priv_size = lport->rport_priv_size;
+@@ -493,10 +495,11 @@ static void fc_rport_enter_delete(struct fc_rport_priv *rdata,
+ 
+ 	fc_rport_state_enter(rdata, RPORT_ST_DELETE);
+ 
+-	kref_get(&rdata->kref);
+-	if (rdata->event == RPORT_EV_NONE &&
+-	    !queue_work(rport_event_queue, &rdata->event_work))
+-		kref_put(&rdata->kref, fc_rport_destroy);
++	if (rdata->event == RPORT_EV_NONE) {
++		kref_get(&rdata->kref);
++		if (!queue_work(rport_event_queue, &rdata->event_work))
++			kref_put(&rdata->kref, fc_rport_destroy);
++	}
+ 
+ 	rdata->event = event;
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
+index 601a4ee60de85..e193fa5963d82 100644
+--- a/drivers/scsi/lpfc/lpfc_ct.c
++++ b/drivers/scsi/lpfc/lpfc_ct.c
+@@ -1714,8 +1714,8 @@ lpfc_fdmi_hba_attr_wwnn(struct lpfc_vport *vport, struct lpfc_fdmi_attr_def *ad)
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, sizeof(struct lpfc_name));
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	memcpy(&ae->un.AttrWWN, &vport->fc_sparam.nodeName,
+ 	       sizeof(struct lpfc_name));
+@@ -1731,8 +1731,8 @@ lpfc_fdmi_hba_attr_manufacturer(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	/* This string MUST be consistent with other FC platforms
+ 	 * supported by Broadcom.
+@@ -1756,8 +1756,8 @@ lpfc_fdmi_hba_attr_sn(struct lpfc_vport *vport, struct lpfc_fdmi_attr_def *ad)
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	strncpy(ae->un.AttrString, phba->SerialNumber,
+ 		sizeof(ae->un.AttrString));
+@@ -1778,8 +1778,8 @@ lpfc_fdmi_hba_attr_model(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	strncpy(ae->un.AttrString, phba->ModelName,
+ 		sizeof(ae->un.AttrString));
+@@ -1799,8 +1799,8 @@ lpfc_fdmi_hba_attr_description(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	strncpy(ae->un.AttrString, phba->ModelDesc,
+ 		sizeof(ae->un.AttrString));
+@@ -1822,8 +1822,8 @@ lpfc_fdmi_hba_attr_hdw_ver(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t i, j, incr, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	/* Convert JEDEC ID to ascii for hardware version */
+ 	incr = vp->rev.biuRev;
+@@ -1852,8 +1852,8 @@ lpfc_fdmi_hba_attr_drvr_ver(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	strncpy(ae->un.AttrString, lpfc_release_version,
+ 		sizeof(ae->un.AttrString));
+@@ -1874,8 +1874,8 @@ lpfc_fdmi_hba_attr_rom_ver(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	if (phba->sli_rev == LPFC_SLI_REV4)
+ 		lpfc_decode_firmware_rev(phba, ae->un.AttrString, 1);
+@@ -1899,8 +1899,8 @@ lpfc_fdmi_hba_attr_fmw_ver(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	lpfc_decode_firmware_rev(phba, ae->un.AttrString, 1);
+ 	len = strnlen(ae->un.AttrString,
+@@ -1919,8 +1919,8 @@ lpfc_fdmi_hba_attr_os_ver(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	snprintf(ae->un.AttrString, sizeof(ae->un.AttrString), "%s %s %s",
+ 		 init_utsname()->sysname,
+@@ -1942,7 +1942,7 @@ lpfc_fdmi_hba_attr_ct_len(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 
+ 	ae->un.AttrInt =  cpu_to_be32(LPFC_MAX_CT_SIZE);
+ 	size = FOURBYTES + sizeof(uint32_t);
+@@ -1958,8 +1958,8 @@ lpfc_fdmi_hba_attr_symbolic_name(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	len = lpfc_vport_symbolic_node_name(vport,
+ 				ae->un.AttrString, 256);
+@@ -1977,7 +1977,7 @@ lpfc_fdmi_hba_attr_vendor_info(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 
+ 	/* Nothing is defined for this currently */
+ 	ae->un.AttrInt =  cpu_to_be32(0);
+@@ -1994,7 +1994,7 @@ lpfc_fdmi_hba_attr_num_ports(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 
+ 	/* Each driver instance corresponds to a single port */
+ 	ae->un.AttrInt =  cpu_to_be32(1);
+@@ -2011,8 +2011,8 @@ lpfc_fdmi_hba_attr_fabric_wwnn(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, sizeof(struct lpfc_name));
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	memcpy(&ae->un.AttrWWN, &vport->fabric_nodename,
+ 	       sizeof(struct lpfc_name));
+@@ -2030,8 +2030,8 @@ lpfc_fdmi_hba_attr_bios_ver(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	lpfc_decode_firmware_rev(phba, ae->un.AttrString, 1);
+ 	len = strnlen(ae->un.AttrString,
+@@ -2050,7 +2050,7 @@ lpfc_fdmi_hba_attr_bios_state(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 
+ 	/* Driver doesn't have access to this information */
+ 	ae->un.AttrInt =  cpu_to_be32(0);
+@@ -2067,8 +2067,8 @@ lpfc_fdmi_hba_attr_vendor_id(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	strncpy(ae->un.AttrString, "EMULEX",
+ 		sizeof(ae->un.AttrString));
+@@ -2089,8 +2089,8 @@ lpfc_fdmi_port_attr_fc4type(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 32);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	ae->un.AttrTypes[3] = 0x02; /* Type 0x1 - ELS */
+ 	ae->un.AttrTypes[2] = 0x01; /* Type 0x8 - FCP */
+@@ -2111,7 +2111,7 @@ lpfc_fdmi_port_attr_support_speed(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 
+ 	ae->un.AttrInt = 0;
+ 	if (!(phba->hba_flag & HBA_FCOE_MODE)) {
+@@ -2161,7 +2161,7 @@ lpfc_fdmi_port_attr_speed(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 
+ 	if (!(phba->hba_flag & HBA_FCOE_MODE)) {
+ 		switch (phba->fc_linkspeed) {
+@@ -2225,7 +2225,7 @@ lpfc_fdmi_port_attr_max_frame(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 
+ 	hsp = (struct serv_parm *)&vport->fc_sparam;
+ 	ae->un.AttrInt = (((uint32_t) hsp->cmn.bbRcvSizeMsb) << 8) |
+@@ -2245,8 +2245,8 @@ lpfc_fdmi_port_attr_os_devname(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	snprintf(ae->un.AttrString, sizeof(ae->un.AttrString),
+ 		 "/sys/class/scsi_host/host%d", shost->host_no);
+@@ -2266,8 +2266,8 @@ lpfc_fdmi_port_attr_host_name(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	snprintf(ae->un.AttrString, sizeof(ae->un.AttrString), "%s",
+ 		 init_utsname()->nodename);
+@@ -2287,8 +2287,8 @@ lpfc_fdmi_port_attr_wwnn(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0,  sizeof(struct lpfc_name));
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	memcpy(&ae->un.AttrWWN, &vport->fc_sparam.nodeName,
+ 	       sizeof(struct lpfc_name));
+@@ -2305,8 +2305,8 @@ lpfc_fdmi_port_attr_wwpn(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0,  sizeof(struct lpfc_name));
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	memcpy(&ae->un.AttrWWN, &vport->fc_sparam.portName,
+ 	       sizeof(struct lpfc_name));
+@@ -2323,8 +2323,8 @@ lpfc_fdmi_port_attr_symbolic_name(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	len = lpfc_vport_symbolic_port_name(vport, ae->un.AttrString, 256);
+ 	len += (len & 3) ? (4 - (len & 3)) : 4;
+@@ -2342,7 +2342,7 @@ lpfc_fdmi_port_attr_port_type(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 	if (phba->fc_topology == LPFC_TOPOLOGY_LOOP)
+ 		ae->un.AttrInt =  cpu_to_be32(LPFC_FDMI_PORTTYPE_NLPORT);
+ 	else
+@@ -2360,7 +2360,7 @@ lpfc_fdmi_port_attr_class(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 	ae->un.AttrInt = cpu_to_be32(FC_COS_CLASS2 | FC_COS_CLASS3);
+ 	size = FOURBYTES + sizeof(uint32_t);
+ 	ad->AttrLen = cpu_to_be16(size);
+@@ -2375,8 +2375,8 @@ lpfc_fdmi_port_attr_fabric_wwpn(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0,  sizeof(struct lpfc_name));
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	memcpy(&ae->un.AttrWWN, &vport->fabric_portname,
+ 	       sizeof(struct lpfc_name));
+@@ -2393,8 +2393,8 @@ lpfc_fdmi_port_attr_active_fc4type(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 32);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	ae->un.AttrTypes[3] = 0x02; /* Type 0x1 - ELS */
+ 	ae->un.AttrTypes[2] = 0x01; /* Type 0x8 - FCP */
+@@ -2414,7 +2414,7 @@ lpfc_fdmi_port_attr_port_state(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 	/* Link Up - operational */
+ 	ae->un.AttrInt =  cpu_to_be32(LPFC_FDMI_PORTSTATE_ONLINE);
+ 	size = FOURBYTES + sizeof(uint32_t);
+@@ -2430,7 +2430,7 @@ lpfc_fdmi_port_attr_num_disc(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 	vport->fdmi_num_disc = lpfc_find_map_node(vport);
+ 	ae->un.AttrInt = cpu_to_be32(vport->fdmi_num_disc);
+ 	size = FOURBYTES + sizeof(uint32_t);
+@@ -2446,7 +2446,7 @@ lpfc_fdmi_port_attr_nportid(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 	ae->un.AttrInt =  cpu_to_be32(vport->fc_myDID);
+ 	size = FOURBYTES + sizeof(uint32_t);
+ 	ad->AttrLen = cpu_to_be16(size);
+@@ -2461,8 +2461,8 @@ lpfc_fdmi_smart_attr_service(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	strncpy(ae->un.AttrString, "Smart SAN Initiator",
+ 		sizeof(ae->un.AttrString));
+@@ -2482,8 +2482,8 @@ lpfc_fdmi_smart_attr_guid(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	memcpy(&ae->un.AttrString, &vport->fc_sparam.nodeName,
+ 	       sizeof(struct lpfc_name));
+@@ -2503,8 +2503,8 @@ lpfc_fdmi_smart_attr_version(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	strncpy(ae->un.AttrString, "Smart SAN Version 2.0",
+ 		sizeof(ae->un.AttrString));
+@@ -2525,8 +2525,8 @@ lpfc_fdmi_smart_attr_model(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t len, size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
+-	memset(ae, 0, 256);
++	ae = &ad->AttrValue;
++	memset(ae, 0, sizeof(*ae));
+ 
+ 	strncpy(ae->un.AttrString, phba->ModelName,
+ 		sizeof(ae->un.AttrString));
+@@ -2545,7 +2545,7 @@ lpfc_fdmi_smart_attr_port_info(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 
+ 	/* SRIOV (type 3) is not supported */
+ 	if (vport->vpi)
+@@ -2565,7 +2565,7 @@ lpfc_fdmi_smart_attr_qos(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 	ae->un.AttrInt =  cpu_to_be32(0);
+ 	size = FOURBYTES + sizeof(uint32_t);
+ 	ad->AttrLen = cpu_to_be16(size);
+@@ -2580,7 +2580,7 @@ lpfc_fdmi_smart_attr_security(struct lpfc_vport *vport,
+ 	struct lpfc_fdmi_attr_entry *ae;
+ 	uint32_t size;
+ 
+-	ae = (struct lpfc_fdmi_attr_entry *)&ad->AttrValue;
++	ae = &ad->AttrValue;
+ 	ae->un.AttrInt =  cpu_to_be32(1);
+ 	size = FOURBYTES + sizeof(uint32_t);
+ 	ad->AttrLen = cpu_to_be16(size);
+@@ -2728,7 +2728,8 @@ lpfc_fdmi_cmd(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ 			/* Registered Port List */
+ 			/* One entry (port) per adapter */
+ 			rh->rpl.EntryCnt = cpu_to_be32(1);
+-			memcpy(&rh->rpl.pe, &phba->pport->fc_sparam.portName,
++			memcpy(&rh->rpl.pe.PortName,
++			       &phba->pport->fc_sparam.portName,
+ 			       sizeof(struct lpfc_name));
+ 
+ 			/* point to the HBA attribute block */
+diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h
+index bdc1f184f67a3..12e033bbe607a 100644
+--- a/drivers/scsi/lpfc/lpfc_hw.h
++++ b/drivers/scsi/lpfc/lpfc_hw.h
+@@ -1326,25 +1326,8 @@ struct fc_rdp_res_frame {
+ /* lpfc_sli_ct_request defines the CT_IU preamble for FDMI commands */
+ #define  SLI_CT_FDMI_Subtypes     0x10	/* Management Service Subtype */
+ 
+-/*
+- * Registered Port List Format
+- */
+-struct lpfc_fdmi_reg_port_list {
+-	uint32_t EntryCnt;
+-	uint32_t pe;		/* Variable-length array */
+-};
+-
+-
+ /* Definitions for HBA / Port attribute entries */
+ 
+-struct lpfc_fdmi_attr_def { /* Defined in TLV format */
+-	/* Structure is in Big Endian format */
+-	uint32_t AttrType:16;
+-	uint32_t AttrLen:16;
+-	uint32_t AttrValue;  /* Marks start of Value (ATTRIBUTE_ENTRY) */
+-};
+-
+-
+ /* Attribute Entry */
+ struct lpfc_fdmi_attr_entry {
+ 	union {
+@@ -1355,7 +1338,13 @@ struct lpfc_fdmi_attr_entry {
+ 	} un;
+ };
+ 
+-#define LPFC_FDMI_MAX_AE_SIZE	sizeof(struct lpfc_fdmi_attr_entry)
++struct lpfc_fdmi_attr_def { /* Defined in TLV format */
++	/* Structure is in Big Endian format */
++	uint32_t AttrType:16;
++	uint32_t AttrLen:16;
++	/* Marks start of Value (ATTRIBUTE_ENTRY) */
++	struct lpfc_fdmi_attr_entry AttrValue;
++} __packed;
+ 
+ /*
+  * HBA Attribute Block
+@@ -1379,13 +1368,20 @@ struct lpfc_fdmi_hba_ident {
+ 	struct lpfc_name PortName;
+ };
+ 
++/*
++ * Registered Port List Format
++ */
++struct lpfc_fdmi_reg_port_list {
++	uint32_t EntryCnt;
++	struct lpfc_fdmi_port_entry pe;
++} __packed;
++
+ /*
+  * Register HBA(RHBA)
+  */
+ struct lpfc_fdmi_reg_hba {
+ 	struct lpfc_fdmi_hba_ident hi;
+-	struct lpfc_fdmi_reg_port_list rpl;	/* variable-length array */
+-/* struct lpfc_fdmi_attr_block   ab; */
++	struct lpfc_fdmi_reg_port_list rpl;
+ };
+ 
+ /*
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 480d2d467f7a6..45445dafc80cf 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -17038,6 +17038,10 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)
+ 			list_add_tail(&iocbq->list, &first_iocbq->list);
+ 		}
+ 	}
++	/* Free the sequence's header buffer */
++	if (!first_iocbq)
++		lpfc_in_buf_free(vport->phba, &seq_dmabuf->dbuf);
++
+ 	return first_iocbq;
+ }
+ 
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index fb6439bc1d9a9..4d7971c3f339b 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -1072,6 +1072,9 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+ 		break;
+ 	}
+ 
++	if (!abrt_conn)
++		wait_delay += qedi->pf_params.iscsi_pf_params.two_msl_timer;
++
+ 	qedi_ep->state = EP_STATE_DISCONN_START;
+ 	ret = qedi_ops->destroy_conn(qedi->cdev, qedi_ep->handle, abrt_conn);
+ 	if (ret) {
+diff --git a/drivers/staging/media/imx/imx-media-capture.c b/drivers/staging/media/imx/imx-media-capture.c
+index ea145bafb880a..8ff8843df5141 100644
+--- a/drivers/staging/media/imx/imx-media-capture.c
++++ b/drivers/staging/media/imx/imx-media-capture.c
+@@ -685,7 +685,7 @@ int imx_media_capture_device_register(struct imx_media_video_dev *vdev)
+ 	/* setup default format */
+ 	fmt_src.pad = priv->src_sd_pad;
+ 	fmt_src.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+-	v4l2_subdev_call(sd, pad, get_fmt, NULL, &fmt_src);
++	ret = v4l2_subdev_call(sd, pad, get_fmt, NULL, &fmt_src);
+ 	if (ret) {
+ 		v4l2_err(sd, "failed to get src_sd format\n");
+ 		goto unreg;
+diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c
+index afb9dadc1cfe9..77685bae21eda 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_recv.c
++++ b/drivers/staging/rtl8188eu/core/rtw_recv.c
+@@ -1541,21 +1541,14 @@ static int amsdu_to_msdu(struct adapter *padapter, struct recv_frame *prframe)
+ 
+ 		/* Allocate new skb for releasing to upper layer */
+ 		sub_skb = dev_alloc_skb(nSubframe_Length + 12);
+-		if (sub_skb) {
+-			skb_reserve(sub_skb, 12);
+-			skb_put_data(sub_skb, pdata, nSubframe_Length);
+-		} else {
+-			sub_skb = skb_clone(prframe->pkt, GFP_ATOMIC);
+-			if (sub_skb) {
+-				sub_skb->data = pdata;
+-				sub_skb->len = nSubframe_Length;
+-				skb_set_tail_pointer(sub_skb, nSubframe_Length);
+-			} else {
+-				DBG_88E("skb_clone() Fail!!! , nr_subframes=%d\n", nr_subframes);
+-				break;
+-			}
++		if (!sub_skb) {
++			DBG_88E("dev_alloc_skb() Fail!!! , nr_subframes=%d\n", nr_subframes);
++			break;
+ 		}
+ 
++		skb_reserve(sub_skb, 12);
++		skb_put_data(sub_skb, pdata, nSubframe_Length);
++
+ 		subframes[nr_subframes++] = sub_skb;
+ 
+ 		if (nr_subframes >= MAX_SUBFRAME_COUNT) {
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index d6b790510c94e..8d46bd612888f 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -1065,8 +1065,10 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+ 			serial8250_apply_quirks(uart);
+ 			ret = uart_add_one_port(&serial8250_reg,
+ 						&uart->port);
+-			if (ret == 0)
+-				ret = uart->port.line;
++			if (ret)
++				goto err;
++
++			ret = uart->port.line;
+ 		} else {
+ 			dev_info(uart->port.dev,
+ 				"skipping CIR port at 0x%lx / 0x%llx, IRQ %d\n",
+@@ -1091,6 +1093,11 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+ 	mutex_unlock(&serial_mutex);
+ 
+ 	return ret;
++
++err:
++	uart->port.dev = NULL;
++	mutex_unlock(&serial_mutex);
++	return ret;
+ }
+ EXPORT_SYMBOL(serial8250_register_8250_port);
+ 
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index da04ba1ecf68a..726852ebef855 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -773,7 +773,10 @@ static void __dma_rx_do_complete(struct uart_8250_port *p)
+ 	dmaengine_tx_status(dma->rxchan, dma->rx_cookie, &state);
+ 
+ 	count = dma->rx_size - state.residue;
+-
++	if (count < dma->rx_size)
++		dmaengine_terminate_async(dma->rxchan);
++	if (!count)
++		goto unlock;
+ 	ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+ 
+ 	p->port.icount.rx += ret;
+@@ -833,7 +836,6 @@ static void omap_8250_rx_dma_flush(struct uart_8250_port *p)
+ 	spin_unlock_irqrestore(&priv->rx_dma_lock, flags);
+ 
+ 	__dma_rx_do_complete(p);
+-	dmaengine_terminate_all(dma->rxchan);
+ }
+ 
+ static int omap_8250_rx_dma(struct uart_8250_port *p)
+@@ -1216,11 +1218,11 @@ static int omap8250_probe(struct platform_device *pdev)
+ 	spin_lock_init(&priv->rx_dma_lock);
+ 
+ 	device_init_wakeup(&pdev->dev, true);
++	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_use_autosuspend(&pdev->dev);
+ 	pm_runtime_set_autosuspend_delay(&pdev->dev, -1);
+ 
+ 	pm_runtime_irq_safe(&pdev->dev);
+-	pm_runtime_enable(&pdev->dev);
+ 
+ 	pm_runtime_get_sync(&pdev->dev);
+ 
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 07d5925791e1c..9880a50d664fc 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1865,6 +1865,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ 	unsigned char status;
+ 	unsigned long flags;
+ 	struct uart_8250_port *up = up_to_u8250p(port);
++	bool skip_rx = false;
+ 
+ 	if (iir & UART_IIR_NO_INT)
+ 		return 0;
+@@ -1873,7 +1874,20 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ 
+ 	status = serial_port_in(port, UART_LSR);
+ 
+-	if (status & (UART_LSR_DR | UART_LSR_BI)) {
++	/*
++	 * If port is stopped and there are no error conditions in the
++	 * FIFO, then don't drain the FIFO, as this may lead to TTY buffer
++	 * overflow. Not servicing, RX FIFO would trigger auto HW flow
++	 * control when FIFO occupancy reaches preset threshold, thus
++	 * halting RX. This only works when auto HW flow control is
++	 * available.
++	 */
++	if (!(status & (UART_LSR_FIFOE | UART_LSR_BRK_ERROR_BITS)) &&
++	    (port->status & (UPSTAT_AUTOCTS | UPSTAT_AUTORTS)) &&
++	    !(port->read_status_mask & UART_LSR_DR))
++		skip_rx = true;
++
++	if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) {
+ 		if (!up->dma || handle_rx_dma(up, iir))
+ 			status = serial8250_rx_chars(up, status);
+ 	}
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index c67d39fea74ca..70d29b697e822 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1165,14 +1165,14 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport,
+ 	struct s3c24xx_uart_info *info = ourport->info;
+ 	struct clk *clk;
+ 	unsigned long rate;
+-	unsigned int cnt, baud, quot, clk_sel, best_quot = 0;
++	unsigned int cnt, baud, quot, best_quot = 0;
+ 	char clkname[MAX_CLK_NAME_LENGTH];
+ 	int calc_deviation, deviation = (1 << 30) - 1;
+ 
+-	clk_sel = (ourport->cfg->clk_sel) ? ourport->cfg->clk_sel :
+-			ourport->info->def_clk_sel;
+ 	for (cnt = 0; cnt < info->num_clks; cnt++) {
+-		if (!(clk_sel & (1 << cnt)))
++		/* Keep selected clock if provided */
++		if (ourport->cfg->clk_sel &&
++			!(ourport->cfg->clk_sel & (1 << cnt)))
+ 			continue;
+ 
+ 		sprintf(clkname, "clk_uart_baud%d", cnt);
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index 81657f09761cd..00a740b8ad273 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1282,6 +1282,7 @@ static int cdns_uart_console_setup(struct console *co, char *options)
+ 	int bits = 8;
+ 	int parity = 'n';
+ 	int flow = 'n';
++	unsigned long time_out;
+ 
+ 	if (co->index < 0 || co->index >= CDNS_UART_NR_PORTS)
+ 		return -EINVAL;
+@@ -1295,6 +1296,13 @@ static int cdns_uart_console_setup(struct console *co, char *options)
+ 	if (options)
+ 		uart_parse_options(options, &baud, &parity, &bits, &flow);
+ 
++	/* Wait for tx_empty before setting up the console */
++	time_out = jiffies + usecs_to_jiffies(TX_TIMEOUT);
++
++	while (time_before(jiffies, time_out) &&
++	       cdns_uart_tx_empty(port) != TIOCSER_TEMT)
++		cpu_relax();
++
+ 	return uart_set_options(port, co, baud, parity, bits, flow);
+ }
+ 
+diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c
+index ef01d24858cd6..4e795353192bc 100644
+--- a/drivers/tty/vcc.c
++++ b/drivers/tty/vcc.c
+@@ -612,6 +612,7 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+ 	port->index = vcc_table_add(port);
+ 	if (port->index == -1) {
+ 		pr_err("VCC: no more TTY indices left for allocation\n");
++		rv = -ENOMEM;
+ 		goto free_ldc;
+ 	}
+ 
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 4149d751719e3..4a42368734644 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -276,7 +276,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
+ {
+ 	const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;
+ 	struct dwc3		*dwc = dep->dwc;
+-	u32			timeout = 1000;
++	u32			timeout = 5000;
+ 	u32			saved_config = 0;
+ 	u32			reg;
+ 
+diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
+index 849806a75f1ce..b29610899c9f6 100644
+--- a/drivers/usb/host/ehci-mv.c
++++ b/drivers/usb/host/ehci-mv.c
+@@ -196,12 +196,10 @@ static int mv_ehci_probe(struct platform_device *pdev)
+ 	hcd->rsrc_len = resource_size(r);
+ 	hcd->regs = ehci_mv->op_regs;
+ 
+-	hcd->irq = platform_get_irq(pdev, 0);
+-	if (!hcd->irq) {
+-		dev_err(&pdev->dev, "Cannot get irq.");
+-		retval = -ENODEV;
++	retval = platform_get_irq(pdev, 0);
++	if (retval < 0)
+ 		goto err_disable_clk;
+-	}
++	hcd->irq = retval;
+ 
+ 	ehci = hcd_to_ehci(hcd);
+ 	ehci->caps = (struct ehci_caps *) ehci_mv->cap_regs;
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 794dc90aa5c95..ac1c54bcfe8fb 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -399,6 +399,19 @@ static void vfio_pci_release(void *device_data)
+ 	if (!(--vdev->refcnt)) {
+ 		vfio_spapr_pci_eeh_release(vdev->pdev);
+ 		vfio_pci_disable(vdev);
++		mutex_lock(&vdev->igate);
++		if (vdev->err_trigger) {
++			eventfd_ctx_put(vdev->err_trigger);
++			vdev->err_trigger = NULL;
++		}
++		mutex_unlock(&vdev->igate);
++
++		mutex_lock(&vdev->igate);
++		if (vdev->req_trigger) {
++			eventfd_ctx_put(vdev->req_trigger);
++			vdev->req_trigger = NULL;
++		}
++		mutex_unlock(&vdev->igate);
+ 	}
+ 
+ 	mutex_unlock(&driver_lock);
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 77ce77a283247..23fb999b49e15 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1777,6 +1777,16 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
+ 	struct gendisk *disk = bdev->bd_disk;
+ 	struct block_device *victim = NULL;
+ 
++	/*
++	 * Sync early if it looks like we're the last one.  If someone else
++	 * opens the block device between now and the decrement of bd_openers
++	 * then we did a sync that we didn't need to, but that's not the end
++	 * of the world and we want to avoid long (could be several minute)
++	 * syncs while holding the mutex.
++	 */
++	if (bdev->bd_openers == 1)
++		sync_blockdev(bdev);
++
+ 	mutex_lock_nested(&bdev->bd_mutex, for_part);
+ 	if (for_part)
+ 		bdev->bd_part_count--;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index cb46ad4b2b0d1..00481cfe6cfce 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -9364,8 +9364,6 @@ out:
+ 	 */
+ 	if (!for_reloc && root_dropped == false)
+ 		btrfs_add_dead_root(root);
+-	if (err && err != -EAGAIN)
+-		btrfs_handle_fs_error(fs_info, err, NULL);
+ 	return err;
+ }
+ 
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 17856e92b93d1..c9e7b92d0f212 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -9204,20 +9204,17 @@ again:
+ 	/*
+ 	 * Qgroup reserved space handler
+ 	 * Page here will be either
+-	 * 1) Already written to disk
+-	 *    In this case, its reserved space is released from data rsv map
+-	 *    and will be freed by delayed_ref handler finally.
+-	 *    So even we call qgroup_free_data(), it won't decrease reserved
+-	 *    space.
+-	 * 2) Not written to disk
+-	 *    This means the reserved space should be freed here. However,
+-	 *    if a truncate invalidates the page (by clearing PageDirty)
+-	 *    and the page is accounted for while allocating extent
+-	 *    in btrfs_check_data_free_space() we let delayed_ref to
+-	 *    free the entire extent.
++	 * 1) Already written to disk or ordered extent already submitted
++	 *    Then its QGROUP_RESERVED bit in io_tree is already cleaned.
++	 *    Qgroup will be handled by its qgroup_record then.
++	 *    btrfs_qgroup_free_data() call will do nothing here.
++	 *
++	 * 2) Not written to disk yet
++	 *    Then btrfs_qgroup_free_data() call will clear the QGROUP_RESERVED
++	 *    bit of its io_tree, and free the qgroup reserved data space.
++	 *    Since the IO will never happen for this page.
+ 	 */
+-	if (PageDirty(page))
+-		btrfs_qgroup_free_data(inode, NULL, page_start, PAGE_SIZE);
++	btrfs_qgroup_free_data(inode, NULL, page_start, PAGE_SIZE);
+ 	if (!inode_evicting) {
+ 		clear_extent_bit(tree, page_start, page_end,
+ 				 EXTENT_LOCKED | EXTENT_DIRTY |
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 589cfe3ed873b..ce94d09f6abf9 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1906,12 +1906,24 @@ ack:
+ 			if (mutex_trylock(&session->s_mutex) == 0) {
+ 				dout("inverting session/ino locks on %p\n",
+ 				     session);
++				session = ceph_get_mds_session(session);
+ 				spin_unlock(&ci->i_ceph_lock);
+ 				if (took_snap_rwsem) {
+ 					up_read(&mdsc->snap_rwsem);
+ 					took_snap_rwsem = 0;
+ 				}
+-				mutex_lock(&session->s_mutex);
++				if (session) {
++					mutex_lock(&session->s_mutex);
++					ceph_put_mds_session(session);
++				} else {
++					/*
++					 * Because we take the reference while
++					 * holding the i_ceph_lock, it should
++					 * never be NULL. Throw a warning if it
++					 * ever is.
++					 */
++					WARN_ON_ONCE(true);
++				}
+ 				goto retry;
+ 			}
+ 		}
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 600bb838c15b8..f166fcb48ac0e 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -246,8 +246,9 @@ struct smb_version_operations {
+ 	int (*check_message)(char *, unsigned int, struct TCP_Server_Info *);
+ 	bool (*is_oplock_break)(char *, struct TCP_Server_Info *);
+ 	int (*handle_cancelled_mid)(char *, struct TCP_Server_Info *);
+-	void (*downgrade_oplock)(struct TCP_Server_Info *,
+-					struct cifsInodeInfo *, bool);
++	void (*downgrade_oplock)(struct TCP_Server_Info *server,
++				 struct cifsInodeInfo *cinode, __u32 oplock,
++				 unsigned int epoch, bool *purge_cache);
+ 	/* process transaction2 response */
+ 	bool (*check_trans2)(struct mid_q_entry *, struct TCP_Server_Info *,
+ 			     char *, int);
+@@ -1092,6 +1093,8 @@ struct cifsFileInfo {
+ 	unsigned int f_flags;
+ 	bool invalidHandle:1;	/* file closed via session abend */
+ 	bool oplock_break_cancelled:1;
++	unsigned int oplock_epoch; /* epoch from the lease break */
++	__u32 oplock_level; /* oplock/lease level from the lease break */
+ 	int count;
+ 	spinlock_t file_info_lock; /* protects four flag/count fields above */
+ 	struct mutex fh_mutex; /* prevents reopen race after dead ses*/
+@@ -1223,7 +1226,7 @@ struct cifsInodeInfo {
+ 	unsigned int epoch;		/* used to track lease state changes */
+ #define CIFS_INODE_PENDING_OPLOCK_BREAK   (0) /* oplock break in progress */
+ #define CIFS_INODE_PENDING_WRITERS	  (1) /* Writes in progress */
+-#define CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 (2) /* Downgrade oplock to L2 */
++#define CIFS_INODE_FLAG_UNUSED		  (2) /* Unused flag */
+ #define CIFS_INO_DELETE_PENDING		  (3) /* delete pending on server */
+ #define CIFS_INO_INVALID_MAPPING	  (4) /* pagecache is invalid */
+ #define CIFS_INO_LOCK			  (5) /* lock bit for synchronization */
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 72e7cbfb325a6..6c77a96437e61 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -3753,7 +3753,8 @@ readpages_get_pages(struct address_space *mapping, struct list_head *page_list,
+ 			break;
+ 
+ 		__SetPageLocked(page);
+-		if (add_to_page_cache_locked(page, mapping, page->index, gfp)) {
++		rc = add_to_page_cache_locked(page, mapping, page->index, gfp);
++		if (rc) {
+ 			__ClearPageLocked(page);
+ 			break;
+ 		}
+@@ -3769,6 +3770,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
+ 	struct list_head *page_list, unsigned num_pages)
+ {
+ 	int rc;
++	int err = 0;
+ 	struct list_head tmplist;
+ 	struct cifsFileInfo *open_file = file->private_data;
+ 	struct cifs_sb_info *cifs_sb = CIFS_FILE_SB(file);
+@@ -3809,7 +3811,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
+ 	 * the order of declining indexes. When we put the pages in
+ 	 * the rdata->pages, then we want them in increasing order.
+ 	 */
+-	while (!list_empty(page_list)) {
++	while (!list_empty(page_list) && !err) {
+ 		unsigned int i, nr_pages, bytes, rsize;
+ 		loff_t offset;
+ 		struct page *page, *tpage;
+@@ -3832,9 +3834,10 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
+ 			return 0;
+ 		}
+ 
+-		rc = readpages_get_pages(mapping, page_list, rsize, &tmplist,
++		nr_pages = 0;
++		err = readpages_get_pages(mapping, page_list, rsize, &tmplist,
+ 					 &nr_pages, &offset, &bytes);
+-		if (rc) {
++		if (!nr_pages) {
+ 			add_credits_and_wake_if(server, credits, 0);
+ 			break;
+ 		}
+@@ -4135,12 +4138,13 @@ void cifs_oplock_break(struct work_struct *work)
+ 	struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
+ 	struct TCP_Server_Info *server = tcon->ses->server;
+ 	int rc = 0;
++	bool purge_cache = false;
+ 
+ 	wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS,
+ 			TASK_UNINTERRUPTIBLE);
+ 
+-	server->ops->downgrade_oplock(server, cinode,
+-		test_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, &cinode->flags));
++	server->ops->downgrade_oplock(server, cinode, cfile->oplock_level,
++				      cfile->oplock_epoch, &purge_cache);
+ 
+ 	if (!CIFS_CACHE_WRITE(cinode) && CIFS_CACHE_READ(cinode) &&
+ 						cifs_has_mand_locks(cinode)) {
+@@ -4155,18 +4159,21 @@ void cifs_oplock_break(struct work_struct *work)
+ 		else
+ 			break_lease(inode, O_WRONLY);
+ 		rc = filemap_fdatawrite(inode->i_mapping);
+-		if (!CIFS_CACHE_READ(cinode)) {
++		if (!CIFS_CACHE_READ(cinode) || purge_cache) {
+ 			rc = filemap_fdatawait(inode->i_mapping);
+ 			mapping_set_error(inode->i_mapping, rc);
+ 			cifs_zap_mapping(inode);
+ 		}
+ 		cifs_dbg(FYI, "Oplock flush inode %p rc %d\n", inode, rc);
++		if (CIFS_CACHE_WRITE(cinode))
++			goto oplock_break_ack;
+ 	}
+ 
+ 	rc = cifs_push_locks(cfile);
+ 	if (rc)
+ 		cifs_dbg(VFS, "Push locks rc = %d\n", rc);
+ 
++oplock_break_ack:
+ 	/*
+ 	 * releasing stale oplock after recent reconnect of smb session using
+ 	 * a now incorrect file handle is not a data integrity issue but do
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 76f1649ab444f..d0e024856c0d4 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -473,21 +473,10 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ 				set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK,
+ 					&pCifsInode->flags);
+ 
+-				/*
+-				 * Set flag if the server downgrades the oplock
+-				 * to L2 else clear.
+-				 */
+-				if (pSMB->OplockLevel)
+-					set_bit(
+-					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+-					   &pCifsInode->flags);
+-				else
+-					clear_bit(
+-					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+-					   &pCifsInode->flags);
+-
+-				cifs_queue_oplock_break(netfile);
++				netfile->oplock_epoch = 0;
++				netfile->oplock_level = pSMB->OplockLevel;
+ 				netfile->oplock_break_cancelled = false;
++				cifs_queue_oplock_break(netfile);
+ 
+ 				spin_unlock(&tcon->open_file_lock);
+ 				spin_unlock(&cifs_tcp_ses_lock);
+diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
+index 483458340b10c..9b271ae641c19 100644
+--- a/fs/cifs/smb1ops.c
++++ b/fs/cifs/smb1ops.c
+@@ -379,12 +379,10 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)
+ 
+ static void
+ cifs_downgrade_oplock(struct TCP_Server_Info *server,
+-			struct cifsInodeInfo *cinode, bool set_level2)
++		      struct cifsInodeInfo *cinode, __u32 oplock,
++		      unsigned int epoch, bool *purge_cache)
+ {
+-	if (set_level2)
+-		cifs_set_oplock_level(cinode, OPLOCK_READ);
+-	else
+-		cifs_set_oplock_level(cinode, 0);
++	cifs_set_oplock_level(cinode, oplock);
+ }
+ 
+ static bool
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index ff2ad15f67d63..0c6e5450ff765 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -496,7 +496,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+ 
+ 		cifs_dbg(FYI, "found in the open list\n");
+ 		cifs_dbg(FYI, "lease key match, lease break 0x%x\n",
+-			 le32_to_cpu(rsp->NewLeaseState));
++			 lease_state);
+ 
+ 		if (ack_req)
+ 			cfile->oplock_break_cancelled = false;
+@@ -505,17 +505,8 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+ 
+ 		set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags);
+ 
+-		/*
+-		 * Set or clear flags depending on the lease state being READ.
+-		 * HANDLE caching flag should be added when the client starts
+-		 * to defer closing remote file handles with HANDLE leases.
+-		 */
+-		if (lease_state & SMB2_LEASE_READ_CACHING_HE)
+-			set_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+-				&cinode->flags);
+-		else
+-			clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+-				  &cinode->flags);
++		cfile->oplock_epoch = le16_to_cpu(rsp->Epoch);
++		cfile->oplock_level = lease_state;
+ 
+ 		cifs_queue_oplock_break(cfile);
+ 		kfree(lw);
+@@ -538,7 +529,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+ 
+ 		cifs_dbg(FYI, "found in the pending open list\n");
+ 		cifs_dbg(FYI, "lease key match, lease break 0x%x\n",
+-			 le32_to_cpu(rsp->NewLeaseState));
++			 lease_state);
+ 
+ 		open->oplock = lease_state;
+ 	}
+@@ -650,18 +641,9 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ 				set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK,
+ 					&cinode->flags);
+ 
+-				/*
+-				 * Set flag if the server downgrades the oplock
+-				 * to L2 else clear.
+-				 */
+-				if (rsp->OplockLevel)
+-					set_bit(
+-					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+-					   &cinode->flags);
+-				else
+-					clear_bit(
+-					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+-					   &cinode->flags);
++				cfile->oplock_epoch = 0;
++				cfile->oplock_level = rsp->OplockLevel;
++
+ 				spin_unlock(&cfile->file_info_lock);
+ 
+ 				cifs_queue_oplock_break(cfile);
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index b46fdb2b8d349..90d4288907a61 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1935,22 +1935,38 @@ static long smb3_fallocate(struct file *file, struct cifs_tcon *tcon, int mode,
+ 
+ static void
+ smb2_downgrade_oplock(struct TCP_Server_Info *server,
+-			struct cifsInodeInfo *cinode, bool set_level2)
++		      struct cifsInodeInfo *cinode, __u32 oplock,
++		      unsigned int epoch, bool *purge_cache)
+ {
+-	if (set_level2)
+-		server->ops->set_oplock_level(cinode, SMB2_OPLOCK_LEVEL_II,
+-						0, NULL);
+-	else
+-		server->ops->set_oplock_level(cinode, 0, 0, NULL);
++	server->ops->set_oplock_level(cinode, oplock, 0, NULL);
+ }
+ 
+ static void
+-smb21_downgrade_oplock(struct TCP_Server_Info *server,
+-		       struct cifsInodeInfo *cinode, bool set_level2)
++smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
++		       unsigned int epoch, bool *purge_cache);
++
++static void
++smb3_downgrade_oplock(struct TCP_Server_Info *server,
++		       struct cifsInodeInfo *cinode, __u32 oplock,
++		       unsigned int epoch, bool *purge_cache)
+ {
+-	server->ops->set_oplock_level(cinode,
+-				      set_level2 ? SMB2_LEASE_READ_CACHING_HE :
+-				      0, 0, NULL);
++	unsigned int old_state = cinode->oplock;
++	unsigned int old_epoch = cinode->epoch;
++	unsigned int new_state;
++
++	if (epoch > old_epoch) {
++		smb21_set_oplock_level(cinode, oplock, 0, NULL);
++		cinode->epoch = epoch;
++	}
++
++	new_state = cinode->oplock;
++	*purge_cache = false;
++
++	if ((old_state & CIFS_CACHE_READ_FLG) != 0 &&
++	    (new_state & CIFS_CACHE_READ_FLG) == 0)
++		*purge_cache = true;
++	else if (old_state == new_state && (epoch - old_epoch > 1))
++		*purge_cache = true;
+ }
+ 
+ static void
+@@ -2953,7 +2969,7 @@ struct smb_version_operations smb21_operations = {
+ 	.print_stats = smb2_print_stats,
+ 	.is_oplock_break = smb2_is_valid_oplock_break,
+ 	.handle_cancelled_mid = smb2_handle_cancelled_mid,
+-	.downgrade_oplock = smb21_downgrade_oplock,
++	.downgrade_oplock = smb2_downgrade_oplock,
+ 	.need_neg = smb2_need_neg,
+ 	.negotiate = smb2_negotiate,
+ 	.negotiate_wsize = smb2_negotiate_wsize,
+@@ -3048,7 +3064,7 @@ struct smb_version_operations smb30_operations = {
+ 	.dump_share_caps = smb2_dump_share_caps,
+ 	.is_oplock_break = smb2_is_valid_oplock_break,
+ 	.handle_cancelled_mid = smb2_handle_cancelled_mid,
+-	.downgrade_oplock = smb21_downgrade_oplock,
++	.downgrade_oplock = smb3_downgrade_oplock,
+ 	.need_neg = smb2_need_neg,
+ 	.negotiate = smb2_negotiate,
+ 	.negotiate_wsize = smb2_negotiate_wsize,
+@@ -3153,7 +3169,7 @@ struct smb_version_operations smb311_operations = {
+ 	.dump_share_caps = smb2_dump_share_caps,
+ 	.is_oplock_break = smb2_is_valid_oplock_break,
+ 	.handle_cancelled_mid = smb2_handle_cancelled_mid,
+-	.downgrade_oplock = smb21_downgrade_oplock,
++	.downgrade_oplock = smb3_downgrade_oplock,
+ 	.need_neg = smb2_need_neg,
+ 	.negotiate = smb2_negotiate,
+ 	.negotiate_wsize = smb2_negotiate_wsize,
+diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
+index bad458a2b579e..f8baa54c83008 100644
+--- a/fs/cifs/smb2pdu.h
++++ b/fs/cifs/smb2pdu.h
+@@ -1046,7 +1046,7 @@ struct smb2_oplock_break {
+ struct smb2_lease_break {
+ 	struct smb2_hdr hdr;
+ 	__le16 StructureSize; /* Must be 44 */
+-	__le16 Reserved;
++	__le16 Epoch;
+ 	__le32 Flags;
+ 	__u8   LeaseKey[16];
+ 	__le32 CurrentLeaseState;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 845b8620afcf6..34da8d341c0c4 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5179,7 +5179,7 @@ static int ext4_do_update_inode(handle_t *handle,
+ 		raw_inode->i_file_acl_high =
+ 			cpu_to_le16(ei->i_file_acl >> 32);
+ 	raw_inode->i_file_acl_lo = cpu_to_le32(ei->i_file_acl);
+-	if (ei->i_disksize != ext4_isize(inode->i_sb, raw_inode)) {
++	if (READ_ONCE(ei->i_disksize) != ext4_isize(inode->i_sb, raw_inode)) {
+ 		ext4_isize_set(raw_inode, ei->i_disksize);
+ 		need_datasync = 1;
+ 	}
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index f580695b7bb9a..1b9c4c19bed29 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -824,7 +824,6 @@ static int fuse_check_page(struct page *page)
+ {
+ 	if (page_mapcount(page) ||
+ 	    page->mapping != NULL ||
+-	    page_count(page) != 1 ||
+ 	    (page->flags & PAGE_FLAGS_CHECK_AT_PREP &
+ 	     ~(1 << PG_locked |
+ 	       1 << PG_referenced |
+diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
+index 6c6401084d3d8..e893b1fbde98b 100644
+--- a/fs/gfs2/inode.c
++++ b/fs/gfs2/inode.c
+@@ -714,7 +714,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+ 
+ 	error = gfs2_trans_begin(sdp, blocks, 0);
+ 	if (error)
+-		goto fail_gunlock2;
++		goto fail_free_inode;
+ 
+ 	if (blocks > 1) {
+ 		ip->i_eattr = ip->i_no_addr + 1;
+@@ -725,7 +725,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+ 
+ 	error = gfs2_glock_get(sdp, ip->i_no_addr, &gfs2_iopen_glops, CREATE, &io_gl);
+ 	if (error)
+-		goto fail_gunlock2;
++		goto fail_free_inode;
+ 
+ 	BUG_ON(test_and_set_bit(GLF_INODE_CREATING, &io_gl->gl_flags));
+ 
+@@ -734,7 +734,6 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+ 		goto fail_gunlock2;
+ 
+ 	glock_set_object(ip->i_iopen_gh.gh_gl, ip);
+-	gfs2_glock_put(io_gl);
+ 	gfs2_set_iop(inode);
+ 	insert_inode_hash(inode);
+ 
+@@ -767,6 +766,8 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+ 
+ 	mark_inode_dirty(inode);
+ 	d_instantiate(dentry, inode);
++	/* After instantiate, errors should result in evict which will destroy
++	 * both inode and iopen glocks properly. */
+ 	if (file) {
+ 		*opened |= FILE_CREATED;
+ 		error = finish_open(file, dentry, gfs2_open_common, opened);
+@@ -774,15 +775,15 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
+ 	gfs2_glock_dq_uninit(ghs);
+ 	gfs2_glock_dq_uninit(ghs + 1);
+ 	clear_bit(GLF_INODE_CREATING, &io_gl->gl_flags);
++	gfs2_glock_put(io_gl);
+ 	return error;
+ 
+ fail_gunlock3:
+ 	glock_clear_object(io_gl, ip);
+ 	gfs2_glock_dq_uninit(&ip->i_iopen_gh);
+-	gfs2_glock_put(io_gl);
+ fail_gunlock2:
+-	if (io_gl)
+-		clear_bit(GLF_INODE_CREATING, &io_gl->gl_flags);
++	clear_bit(GLF_INODE_CREATING, &io_gl->gl_flags);
++	gfs2_glock_put(io_gl);
+ fail_free_inode:
+ 	if (ip->i_gl) {
+ 		glock_clear_object(ip->i_gl, ip);
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 7c01936be7c70..37358dba3b033 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -132,47 +132,70 @@ nfs_async_iocounter_wait(struct rpc_task *task, struct nfs_lock_context *l_ctx)
+ EXPORT_SYMBOL_GPL(nfs_async_iocounter_wait);
+ 
+ /*
+- * nfs_page_group_lock - lock the head of the page group
+- * @req - request in group that is to be locked
++ * nfs_page_set_headlock - set the request PG_HEADLOCK
++ * @req: request that is to be locked
+  *
+- * this lock must be held when traversing or modifying the page
+- * group list
++ * this lock must be held when modifying req->wb_head
+  *
+  * return 0 on success, < 0 on error
+  */
+ int
+-nfs_page_group_lock(struct nfs_page *req)
++nfs_page_set_headlock(struct nfs_page *req)
+ {
+-	struct nfs_page *head = req->wb_head;
+-
+-	WARN_ON_ONCE(head != head->wb_head);
+-
+-	if (!test_and_set_bit(PG_HEADLOCK, &head->wb_flags))
++	if (!test_and_set_bit(PG_HEADLOCK, &req->wb_flags))
+ 		return 0;
+ 
+-	set_bit(PG_CONTENDED1, &head->wb_flags);
++	set_bit(PG_CONTENDED1, &req->wb_flags);
+ 	smp_mb__after_atomic();
+-	return wait_on_bit_lock(&head->wb_flags, PG_HEADLOCK,
++	return wait_on_bit_lock(&req->wb_flags, PG_HEADLOCK,
+ 				TASK_UNINTERRUPTIBLE);
+ }
+ 
+ /*
+- * nfs_page_group_unlock - unlock the head of the page group
+- * @req - request in group that is to be unlocked
++ * nfs_page_clear_headlock - clear the request PG_HEADLOCK
++ * @req: request that is to be locked
+  */
+ void
+-nfs_page_group_unlock(struct nfs_page *req)
++nfs_page_clear_headlock(struct nfs_page *req)
+ {
+-	struct nfs_page *head = req->wb_head;
+-
+-	WARN_ON_ONCE(head != head->wb_head);
+-
+ 	smp_mb__before_atomic();
+-	clear_bit(PG_HEADLOCK, &head->wb_flags);
++	clear_bit(PG_HEADLOCK, &req->wb_flags);
+ 	smp_mb__after_atomic();
+-	if (!test_bit(PG_CONTENDED1, &head->wb_flags))
++	if (!test_bit(PG_CONTENDED1, &req->wb_flags))
+ 		return;
+-	wake_up_bit(&head->wb_flags, PG_HEADLOCK);
++	wake_up_bit(&req->wb_flags, PG_HEADLOCK);
++}
++
++/*
++ * nfs_page_group_lock - lock the head of the page group
++ * @req: request in group that is to be locked
++ *
++ * this lock must be held when traversing or modifying the page
++ * group list
++ *
++ * return 0 on success, < 0 on error
++ */
++int
++nfs_page_group_lock(struct nfs_page *req)
++{
++	int ret;
++
++	ret = nfs_page_set_headlock(req);
++	if (ret || req->wb_head == req)
++		return ret;
++	return nfs_page_set_headlock(req->wb_head);
++}
++
++/*
++ * nfs_page_group_unlock - unlock the head of the page group
++ * @req: request in group that is to be unlocked
++ */
++void
++nfs_page_group_unlock(struct nfs_page *req)
++{
++	if (req != req->wb_head)
++		nfs_page_clear_headlock(req->wb_head);
++	nfs_page_clear_headlock(req);
+ }
+ 
+ /*
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 7b6bda68aa86a..767e46c09074b 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -406,22 +406,28 @@ nfs_destroy_unlinked_subrequests(struct nfs_page *destroy_list,
+ 		destroy_list = (subreq->wb_this_page == old_head) ?
+ 				   NULL : subreq->wb_this_page;
+ 
++		/* Note: lock subreq in order to change subreq->wb_head */
++		nfs_page_set_headlock(subreq);
+ 		WARN_ON_ONCE(old_head != subreq->wb_head);
+ 
+ 		/* make sure old group is not used */
+ 		subreq->wb_this_page = subreq;
++		subreq->wb_head = subreq;
+ 
+ 		clear_bit(PG_REMOVE, &subreq->wb_flags);
+ 
+ 		/* Note: races with nfs_page_group_destroy() */
+ 		if (!kref_read(&subreq->wb_kref)) {
+ 			/* Check if we raced with nfs_page_group_destroy() */
+-			if (test_and_clear_bit(PG_TEARDOWN, &subreq->wb_flags))
++			if (test_and_clear_bit(PG_TEARDOWN, &subreq->wb_flags)) {
++				nfs_page_clear_headlock(subreq);
+ 				nfs_free_request(subreq);
++			} else
++				nfs_page_clear_headlock(subreq);
+ 			continue;
+ 		}
++		nfs_page_clear_headlock(subreq);
+ 
+-		subreq->wb_head = subreq;
+ 		nfs_release_request(old_head);
+ 
+ 		if (test_and_clear_bit(PG_INODE_REF, &subreq->wb_flags)) {
+diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
+index 3be28900bf375..135e95950f513 100644
+--- a/fs/ubifs/io.c
++++ b/fs/ubifs/io.c
+@@ -237,7 +237,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum)
+ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
+ 		     int offs, int quiet, int must_chk_crc)
+ {
+-	int err = -EINVAL, type, node_len;
++	int err = -EINVAL, type, node_len, dump_node = 1;
+ 	uint32_t crc, node_crc, magic;
+ 	const struct ubifs_ch *ch = buf;
+ 
+@@ -290,10 +290,22 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
+ out_len:
+ 	if (!quiet)
+ 		ubifs_err(c, "bad node length %d", node_len);
++	if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ)
++		dump_node = 0;
+ out:
+ 	if (!quiet) {
+ 		ubifs_err(c, "bad node at LEB %d:%d", lnum, offs);
+-		ubifs_dump_node(c, buf);
++		if (dump_node) {
++			ubifs_dump_node(c, buf);
++		} else {
++			int safe_len = min3(node_len, c->leb_size - offs,
++				(int)UBIFS_MAX_DATA_NODE_SZ);
++			pr_err("\tprevent out-of-bounds memory access\n");
++			pr_err("\ttruncated data node length      %d\n", safe_len);
++			pr_err("\tcorrupted data node:\n");
++			print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
++					buf, safe_len, 0);
++		}
+ 		dump_stack();
+ 	}
+ 	return err;
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index 299d17b088e21..facb83031ba77 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -1335,7 +1335,9 @@ xfs_attr3_leaf_add_work(
+ 	for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) {
+ 		if (ichdr->freemap[i].base == tmp) {
+ 			ichdr->freemap[i].base += sizeof(xfs_attr_leaf_entry_t);
+-			ichdr->freemap[i].size -= sizeof(xfs_attr_leaf_entry_t);
++			ichdr->freemap[i].size -=
++				min_t(uint16_t, ichdr->freemap[i].size,
++						sizeof(xfs_attr_leaf_entry_t));
+ 		}
+ 	}
+ 	ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index);
+diff --git a/fs/xfs/libxfs/xfs_dir2_node.c b/fs/xfs/libxfs/xfs_dir2_node.c
+index 682e2bf370c72..ee4ebc2dd7492 100644
+--- a/fs/xfs/libxfs/xfs_dir2_node.c
++++ b/fs/xfs/libxfs/xfs_dir2_node.c
+@@ -212,6 +212,7 @@ __xfs_dir3_free_read(
+ 		xfs_buf_ioerror(*bpp, -EFSCORRUPTED);
+ 		xfs_verifier_error(*bpp);
+ 		xfs_trans_brelse(tp, *bpp);
++		*bpp = NULL;
+ 		return -EFSCORRUPTED;
+ 	}
+ 
+diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
+index b93efc8feecd1..755033acd2b0d 100644
+--- a/include/linux/debugfs.h
++++ b/include/linux/debugfs.h
+@@ -77,6 +77,8 @@ static const struct file_operations __fops = {				\
+ 	.llseek  = no_llseek,						\
+ }
+ 
++typedef struct vfsmount *(*debugfs_automount_t)(struct dentry *, void *);
++
+ #if defined(CONFIG_DEBUG_FS)
+ 
+ struct dentry *debugfs_lookup(const char *name, struct dentry *parent);
+@@ -98,7 +100,6 @@ struct dentry *debugfs_create_dir(const char *name, struct dentry *parent);
+ struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
+ 				      const char *dest);
+ 
+-typedef struct vfsmount *(*debugfs_automount_t)(struct dentry *, void *);
+ struct dentry *debugfs_create_automount(const char *name,
+ 					struct dentry *parent,
+ 					debugfs_automount_t f,
+@@ -227,7 +228,7 @@ static inline struct dentry *debugfs_create_symlink(const char *name,
+ 
+ static inline struct dentry *debugfs_create_automount(const char *name,
+ 					struct dentry *parent,
+-					struct vfsmount *(*f)(void *),
++					debugfs_automount_t f,
+ 					void *data)
+ {
+ 	return ERR_PTR(-ENODEV);
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index f772c55ed901d..c5c34fd78c5a5 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -504,6 +504,7 @@ enum hsm_task_states {
+ };
+ 
+ enum ata_completion_errors {
++	AC_ERR_OK		= 0,	    /* no error */
+ 	AC_ERR_DEV		= (1 << 0), /* device reported error */
+ 	AC_ERR_HSM		= (1 << 1), /* host state machine violation */
+ 	AC_ERR_TIMEOUT		= (1 << 2), /* timeout */
+@@ -909,9 +910,9 @@ struct ata_port_operations {
+ 	/*
+ 	 * Command execution
+ 	 */
+-	int  (*qc_defer)(struct ata_queued_cmd *qc);
+-	int  (*check_atapi_dma)(struct ata_queued_cmd *qc);
+-	void (*qc_prep)(struct ata_queued_cmd *qc);
++	int (*qc_defer)(struct ata_queued_cmd *qc);
++	int (*check_atapi_dma)(struct ata_queued_cmd *qc);
++	enum ata_completion_errors (*qc_prep)(struct ata_queued_cmd *qc);
+ 	unsigned int (*qc_issue)(struct ata_queued_cmd *qc);
+ 	bool (*qc_fill_rtf)(struct ata_queued_cmd *qc);
+ 
+@@ -1175,7 +1176,7 @@ extern int ata_xfer_mode2shift(unsigned long xfer_mode);
+ extern const char *ata_mode_string(unsigned long xfer_mask);
+ extern unsigned long ata_id_xfermask(const u16 *id);
+ extern int ata_std_qc_defer(struct ata_queued_cmd *qc);
+-extern void ata_noop_qc_prep(struct ata_queued_cmd *qc);
++extern enum ata_completion_errors ata_noop_qc_prep(struct ata_queued_cmd *qc);
+ extern void ata_sg_init(struct ata_queued_cmd *qc, struct scatterlist *sg,
+ 		 unsigned int n_elem);
+ extern unsigned int ata_dev_classify(const struct ata_taskfile *tf);
+@@ -1889,9 +1890,9 @@ extern const struct ata_port_operations ata_bmdma_port_ops;
+ 	.sg_tablesize		= LIBATA_MAX_PRD,		\
+ 	.dma_boundary		= ATA_DMA_BOUNDARY
+ 
+-extern void ata_bmdma_qc_prep(struct ata_queued_cmd *qc);
++extern enum ata_completion_errors ata_bmdma_qc_prep(struct ata_queued_cmd *qc);
+ extern unsigned int ata_bmdma_qc_issue(struct ata_queued_cmd *qc);
+-extern void ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc);
++extern enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc);
+ extern unsigned int ata_bmdma_port_intr(struct ata_port *ap,
+ 				      struct ata_queued_cmd *qc);
+ extern irqreturn_t ata_bmdma_interrupt(int irq, void *dev_instance);
+diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
+index 279b39008a33b..de81ed857ea37 100644
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -226,7 +226,7 @@ struct mmc_queue_req;
+  * MMC Physical partitions
+  */
+ struct mmc_part {
+-	unsigned int	size;	/* partition size (in bytes) */
++	u64		size;	/* partition size (in bytes) */
+ 	unsigned int	part_cfg;	/* partition type */
+ 	char	name[MAX_MMC_PART_NAME_LEN];
+ 	bool	force_ro;	/* to make boot parts RO by default */
+diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h
+index ad69430fd0eb5..5162fc1533c2f 100644
+--- a/include/linux/nfs_page.h
++++ b/include/linux/nfs_page.h
+@@ -142,6 +142,8 @@ extern	void nfs_unlock_and_release_request(struct nfs_page *);
+ extern int nfs_page_group_lock(struct nfs_page *);
+ extern void nfs_page_group_unlock(struct nfs_page *);
+ extern bool nfs_page_group_sync_on_bit(struct nfs_page *, unsigned int);
++extern	int nfs_page_set_headlock(struct nfs_page *req);
++extern void nfs_page_clear_headlock(struct nfs_page *req);
+ extern bool nfs_async_iocounter_wait(struct rpc_task *, struct nfs_lock_context *);
+ 
+ /*
+diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
+index f189a8a3bbb88..7b3b5d05ab0de 100644
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -243,6 +243,13 @@ static inline void raw_write_seqcount_end(seqcount_t *s)
+  * usual consistency guarantee. It is one wmb cheaper, because we can
+  * collapse the two back-to-back wmb()s.
+  *
++ * Note that, writes surrounding the barrier should be declared atomic (e.g.
++ * via WRITE_ONCE): a) to ensure the writes become visible to other threads
++ * atomically, avoiding compiler optimizations; b) to document which writes are
++ * meant to propagate to the reader critical section. This is necessary because
++ * neither writes before and after the barrier are enclosed in a seq-writer
++ * critical section that would ensure readers are aware of ongoing writes.
++ *
+  *      seqcount_t seq;
+  *      bool X = true, Y = false;
+  *
+@@ -262,11 +269,11 @@ static inline void raw_write_seqcount_end(seqcount_t *s)
+  *
+  *      void write(void)
+  *      {
+- *              Y = true;
++ *              WRITE_ONCE(Y, true);
+  *
+  *              raw_write_seqcount_barrier(seq);
+  *
+- *              X = false;
++ *              WRITE_ONCE(X, false);
+  *      }
+  */
+ static inline void raw_write_seqcount_barrier(seqcount_t *s)
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index a9a764a17c289..3690985e24a8a 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1674,6 +1674,18 @@ static inline __u32 skb_queue_len(const struct sk_buff_head *list_)
+ 	return list_->qlen;
+ }
+ 
++/**
++ *	skb_queue_len_lockless	- get queue length
++ *	@list_: list to measure
++ *
++ *	Return the length of an &sk_buff queue.
++ *	This variant can be used in lockless contexts.
++ */
++static inline __u32 skb_queue_len_lockless(const struct sk_buff_head *list_)
++{
++	return READ_ONCE(list_->qlen);
++}
++
+ /**
+  *	__skb_queue_head_init - initialize non-spinlock portions of sk_buff_head
+  *	@list: queue to initialize
+@@ -1881,7 +1893,7 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
+ {
+ 	struct sk_buff *next, *prev;
+ 
+-	list->qlen--;
++	WRITE_ONCE(list->qlen, list->qlen - 1);
+ 	next	   = skb->next;
+ 	prev	   = skb->prev;
+ 	skb->next  = skb->prev = NULL;
+@@ -2999,8 +3011,9 @@ static inline int skb_padto(struct sk_buff *skb, unsigned int len)
+  *	is untouched. Otherwise it is extended. Returns zero on
+  *	success. The skb is freed on error if @free_on_error is true.
+  */
+-static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len,
+-				  bool free_on_error)
++static inline int __must_check __skb_put_padto(struct sk_buff *skb,
++					       unsigned int len,
++					       bool free_on_error)
+ {
+ 	unsigned int size = skb->len;
+ 
+@@ -3023,7 +3036,7 @@ static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len,
+  *	is untouched. Otherwise it is extended. Returns zero on
+  *	success. The skb is freed on error.
+  */
+-static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
++static inline int __must_check skb_put_padto(struct sk_buff *skb, unsigned int len)
+ {
+ 	return __skb_put_padto(skb, len, true);
+ }
+diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
+index 35f1d706bd5b4..ac87820cc0825 100644
+--- a/kernel/audit_watch.c
++++ b/kernel/audit_watch.c
+@@ -316,8 +316,6 @@ static void audit_update_watch(struct audit_parent *parent,
+ 			if (oentry->rule.exe)
+ 				audit_remove_mark(oentry->rule.exe);
+ 
+-			audit_watch_log_rule_change(r, owatch, "updated_rules");
+-
+ 			call_rcu(&oentry->rcu, audit_free_rule_rcu);
+ 		}
+ 
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index 6cc090d015f66..ecc58137525bc 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -645,15 +645,7 @@ static void htab_elem_free_rcu(struct rcu_head *head)
+ 	struct htab_elem *l = container_of(head, struct htab_elem, rcu);
+ 	struct bpf_htab *htab = l->htab;
+ 
+-	/* must increment bpf_prog_active to avoid kprobe+bpf triggering while
+-	 * we're calling kfree, otherwise deadlock is possible if kprobes
+-	 * are placed somewhere inside of slub
+-	 */
+-	preempt_disable();
+-	__this_cpu_inc(bpf_prog_active);
+ 	htab_elem_free(htab, l);
+-	__this_cpu_dec(bpf_prog_active);
+-	preempt_enable();
+ }
+ 
+ static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 7b3a5c35904a0..fdf6656cce292 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2117,6 +2117,9 @@ static void kill_kprobe(struct kprobe *p)
+ {
+ 	struct kprobe *kp;
+ 
++	if (WARN_ON_ONCE(kprobe_gone(p)))
++		return;
++
+ 	p->flags |= KPROBE_FLAG_GONE;
+ 	if (kprobe_aggrprobe(p)) {
+ 		/*
+@@ -2137,9 +2140,10 @@ static void kill_kprobe(struct kprobe *p)
+ 
+ 	/*
+ 	 * The module is going away. We should disarm the kprobe which
+-	 * is using ftrace.
++	 * is using ftrace, because ftrace framework is still available at
++	 * MODULE_STATE_GOING notification.
+ 	 */
+-	if (kprobe_ftrace(p))
++	if (kprobe_ftrace(p) && !kprobe_disabled(p) && !kprobes_all_disarmed)
+ 		disarm_kprobe_ftrace(p);
+ }
+ 
+@@ -2259,7 +2263,10 @@ static int kprobes_module_callback(struct notifier_block *nb,
+ 	mutex_lock(&kprobe_mutex);
+ 	for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
+ 		head = &kprobe_table[i];
+-		hlist_for_each_entry_rcu(p, head, hlist)
++		hlist_for_each_entry_rcu(p, head, hlist) {
++			if (kprobe_gone(p))
++				continue;
++
+ 			if (within_module_init((unsigned long)p->addr, mod) ||
+ 			    (checkcore &&
+ 			     within_module_core((unsigned long)p->addr, mod))) {
+@@ -2276,6 +2283,7 @@ static int kprobes_module_callback(struct notifier_block *nb,
+ 				 */
+ 				kill_kprobe(p);
+ 			}
++		}
+ 	}
+ 	mutex_unlock(&kprobe_mutex);
+ 	return NOTIFY_DONE;
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 4e50beb162c00..f96b22db5fe70 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2092,6 +2092,9 @@ static int __init console_setup(char *str)
+ 	char *s, *options, *brl_options = NULL;
+ 	int idx;
+ 
++	if (str[0] == 0)
++		return 1;
++
+ 	if (_braille_console_setup(&str, &brl_options))
+ 		return 1;
+ 
+diff --git a/kernel/sys.c b/kernel/sys.c
+index ab96b98823473..2e4f017f7c5aa 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1217,11 +1217,13 @@ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
+ 
+ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
+ {
+-	struct oldold_utsname tmp = {};
++	struct oldold_utsname tmp;
+ 
+ 	if (!name)
+ 		return -EFAULT;
+ 
++	memset(&tmp, 0, sizeof(tmp));
++
+ 	down_read(&uts_sem);
+ 	memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN);
+ 	memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN);
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 1ce7c404d0b03..5b6f815a74ee3 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -988,9 +988,8 @@ static int scale64_check_overflow(u64 mult, u64 div, u64 *base)
+ 	    ((int)sizeof(u64)*8 - fls64(mult) < fls64(rem)))
+ 		return -EOVERFLOW;
+ 	tmp *= mult;
+-	rem *= mult;
+ 
+-	do_div(rem, div);
++	rem = div64_u64(rem * mult, div);
+ 	*base = tmp + rem;
+ 	return 0;
+ }
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 95ede1f7ffdf3..19526297a5b1c 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -3035,6 +3035,9 @@ int trace_array_printk(struct trace_array *tr,
+ 	if (!(global_trace.trace_flags & TRACE_ITER_PRINTK))
+ 		return 0;
+ 
++	if (!tr)
++		return -ENOENT;
++
+ 	va_start(ap, fmt);
+ 	ret = trace_array_vprintk(tr, ip, fmt, ap);
+ 	va_end(ap);
+@@ -8343,7 +8346,7 @@ __init static int tracer_alloc_buffers(void)
+ 		goto out_free_buffer_mask;
+ 
+ 	/* Only allocate trace_printk buffers if a trace_printk exists */
+-	if (__stop___trace_bprintk_fmt != __start___trace_bprintk_fmt)
++	if (&__stop___trace_bprintk_fmt != &__start___trace_bprintk_fmt)
+ 		/* Must be called before global_trace.buffer is allocated */
+ 		trace_printk_init_buffers();
+ 
+diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
+index e3a658bac10fe..ff91acff72946 100644
+--- a/kernel/trace/trace_entries.h
++++ b/kernel/trace/trace_entries.h
+@@ -179,7 +179,7 @@ FTRACE_ENTRY(kernel_stack, stack_entry,
+ 
+ 	F_STRUCT(
+ 		__field(	int,		size	)
+-		__dynamic_array(unsigned long,	caller	)
++		__array(	unsigned long,	caller,	FTRACE_STACK_ENTRIES	)
+ 	),
+ 
+ 	F_printk("\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n"
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index e72a44ecb81da..d69c79ac97986 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -799,6 +799,8 @@ static int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set)
+ 	char *event = NULL, *sub = NULL, *match;
+ 	int ret;
+ 
++	if (!tr)
++		return -ENOENT;
+ 	/*
+ 	 * The buf format can be <subsystem>:<event-name>
+ 	 *  *:<event-name> means any event by that name.
+diff --git a/lib/string.c b/lib/string.c
+index 33befc6ba3faf..db9abc18b2165 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -236,6 +236,30 @@ ssize_t strscpy(char *dest, const char *src, size_t count)
+ EXPORT_SYMBOL(strscpy);
+ #endif
+ 
++/**
++ * stpcpy - copy a string from src to dest returning a pointer to the new end
++ *          of dest, including src's %NUL-terminator. May overrun dest.
++ * @dest: pointer to end of string being copied into. Must be large enough
++ *        to receive copy.
++ * @src: pointer to the beginning of string being copied from. Must not overlap
++ *       dest.
++ *
++ * stpcpy differs from strcpy in a key way: the return value is a pointer
++ * to the new %NUL-terminating character in @dest. (For strcpy, the return
++ * value is a pointer to the start of @dest). This interface is considered
++ * unsafe as it doesn't perform bounds checking of the inputs. As such it's
++ * not recommended for usage. Instead, its definition is provided in case
++ * the compiler lowers other libcalls to stpcpy.
++ */
++char *stpcpy(char *__restrict__ dest, const char *__restrict__ src);
++char *stpcpy(char *__restrict__ dest, const char *__restrict__ src)
++{
++	while ((*dest++ = *src++) != '\0')
++		/* nothing */;
++	return --dest;
++}
++EXPORT_SYMBOL(stpcpy);
++
+ #ifndef __HAVE_ARCH_STRCAT
+ /**
+  * strcat - Append one %NUL-terminated string to another
+diff --git a/mm/filemap.c b/mm/filemap.c
+index a30dbf93de992..471f8091d782a 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -2774,6 +2774,14 @@ filler:
+ 		unlock_page(page);
+ 		goto out;
+ 	}
++
++	/*
++	 * A previous I/O error may have been due to temporary
++	 * failures.
++	 * Clear page error before actual read, PG_error will be
++	 * set again if read page fails.
++	 */
++	ClearPageError(page);
+ 	goto filler;
+ 
+ out:
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 9f3d4f84032bc..51068ef1dff5a 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2078,7 +2078,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
+ 		put_page(page);
+ 		add_mm_counter(mm, MM_FILEPAGES, -HPAGE_PMD_NR);
+ 		return;
+-	} else if (is_huge_zero_pmd(*pmd)) {
++	} else if (pmd_trans_huge(*pmd) && is_huge_zero_pmd(*pmd)) {
+ 		return __split_huge_zero_page_pmd(vma, haddr, pmd);
+ 	}
+ 
+@@ -2131,27 +2131,33 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
+ 		pte = pte_offset_map(&_pmd, addr);
+ 		BUG_ON(!pte_none(*pte));
+ 		set_pte_at(mm, addr, pte, entry);
+-		atomic_inc(&page[i]._mapcount);
+-		pte_unmap(pte);
+-	}
+-
+-	/*
+-	 * Set PG_double_map before dropping compound_mapcount to avoid
+-	 * false-negative page_mapped().
+-	 */
+-	if (compound_mapcount(page) > 1 && !TestSetPageDoubleMap(page)) {
+-		for (i = 0; i < HPAGE_PMD_NR; i++)
++		if (!pmd_migration)
+ 			atomic_inc(&page[i]._mapcount);
++		pte_unmap(pte);
+ 	}
+ 
+-	if (atomic_add_negative(-1, compound_mapcount_ptr(page))) {
+-		/* Last compound_mapcount is gone. */
+-		__dec_node_page_state(page, NR_ANON_THPS);
+-		if (TestClearPageDoubleMap(page)) {
+-			/* No need in mapcount reference anymore */
++	if (!pmd_migration) {
++		/*
++		 * Set PG_double_map before dropping compound_mapcount to avoid
++		 * false-negative page_mapped().
++		 */
++		if (compound_mapcount(page) > 1 &&
++		    !TestSetPageDoubleMap(page)) {
+ 			for (i = 0; i < HPAGE_PMD_NR; i++)
+-				atomic_dec(&page[i]._mapcount);
++				atomic_inc(&page[i]._mapcount);
++		}
++
++		lock_page_memcg(page);
++		if (atomic_add_negative(-1, compound_mapcount_ptr(page))) {
++			/* Last compound_mapcount is gone. */
++			__dec_lruvec_page_state(page, NR_ANON_THPS);
++			if (TestClearPageDoubleMap(page)) {
++				/* No need in mapcount reference anymore */
++				for (i = 0; i < HPAGE_PMD_NR; i++)
++					atomic_dec(&page[i]._mapcount);
++			}
+ 		}
++		unlock_page_memcg(page);
+ 	}
+ 
+ 	smp_wmb(); /* make pte visible before pmd */
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index d779181bed4d8..706f705c2e0a4 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -2030,7 +2030,7 @@ void __init kmemleak_init(void)
+ 	create_object((unsigned long)__bss_start, __bss_stop - __bss_start,
+ 		      KMEMLEAK_GREY, GFP_ATOMIC);
+ 	/* only register .data..ro_after_init if not within .data */
+-	if (__start_ro_after_init < _sdata || __end_ro_after_init > _edata)
++	if (&__start_ro_after_init < &_sdata || &__end_ro_after_init > &_edata)
+ 		create_object((unsigned long)__start_ro_after_init,
+ 			      __end_ro_after_init - __start_ro_after_init,
+ 			      KMEMLEAK_GREY, GFP_ATOMIC);
+diff --git a/mm/memory.c b/mm/memory.c
+index e9bce27bc18c3..caefa5526b20c 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -117,6 +117,18 @@ int randomize_va_space __read_mostly =
+ 					2;
+ #endif
+ 
++#ifndef arch_faults_on_old_pte
++static inline bool arch_faults_on_old_pte(void)
++{
++	/*
++	 * Those arches which don't have hw access flag feature need to
++	 * implement their own helper. By default, "true" means pagefault
++	 * will be hit on old pte.
++	 */
++	return true;
++}
++#endif
++
+ static int __init disable_randmaps(char *s)
+ {
+ 	randomize_va_space = 0;
+@@ -2324,32 +2336,101 @@ static inline int pte_unmap_same(struct mm_struct *mm, pmd_t *pmd,
+ 	return same;
+ }
+ 
+-static inline void cow_user_page(struct page *dst, struct page *src, unsigned long va, struct vm_area_struct *vma)
++static inline bool cow_user_page(struct page *dst, struct page *src,
++				 struct vm_fault *vmf)
+ {
++	bool ret;
++	void *kaddr;
++	void __user *uaddr;
++	bool locked = false;
++	struct vm_area_struct *vma = vmf->vma;
++	struct mm_struct *mm = vma->vm_mm;
++	unsigned long addr = vmf->address;
++
+ 	debug_dma_assert_idle(src);
+ 
++	if (likely(src)) {
++		copy_user_highpage(dst, src, addr, vma);
++		return true;
++	}
++
+ 	/*
+ 	 * If the source page was a PFN mapping, we don't have
+ 	 * a "struct page" for it. We do a best-effort copy by
+ 	 * just copying from the original user address. If that
+ 	 * fails, we just zero-fill it. Live with it.
+ 	 */
+-	if (unlikely(!src)) {
+-		void *kaddr = kmap_atomic(dst);
+-		void __user *uaddr = (void __user *)(va & PAGE_MASK);
++	kaddr = kmap_atomic(dst);
++	uaddr = (void __user *)(addr & PAGE_MASK);
++
++	/*
++	 * On architectures with software "accessed" bits, we would
++	 * take a double page fault, so mark it accessed here.
++	 */
++	if (arch_faults_on_old_pte() && !pte_young(vmf->orig_pte)) {
++		pte_t entry;
++
++		vmf->pte = pte_offset_map_lock(mm, vmf->pmd, addr, &vmf->ptl);
++		locked = true;
++		if (!likely(pte_same(*vmf->pte, vmf->orig_pte))) {
++			/*
++			 * Other thread has already handled the fault
++			 * and we don't need to do anything. If it's
++			 * not the case, the fault will be triggered
++			 * again on the same address.
++			 */
++			ret = false;
++			goto pte_unlock;
++		}
++
++		entry = pte_mkyoung(vmf->orig_pte);
++		if (ptep_set_access_flags(vma, addr, vmf->pte, entry, 0))
++			update_mmu_cache(vma, addr, vmf->pte);
++	}
++
++	/*
++	 * This really shouldn't fail, because the page is there
++	 * in the page tables. But it might just be unreadable,
++	 * in which case we just give up and fill the result with
++	 * zeroes.
++	 */
++	if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) {
++		if (locked)
++			goto warn;
++
++		/* Re-validate under PTL if the page is still mapped */
++		vmf->pte = pte_offset_map_lock(mm, vmf->pmd, addr, &vmf->ptl);
++		locked = true;
++		if (!likely(pte_same(*vmf->pte, vmf->orig_pte))) {
++			/* The PTE changed under us. Retry page fault. */
++			ret = false;
++			goto pte_unlock;
++		}
+ 
+ 		/*
+-		 * This really shouldn't fail, because the page is there
+-		 * in the page tables. But it might just be unreadable,
+-		 * in which case we just give up and fill the result with
+-		 * zeroes.
++		 * The same page can be mapped back since last copy attampt.
++		 * Try to copy again under PTL.
+ 		 */
+-		if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE))
++		if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE)) {
++			/*
++			 * Give a warn in case there can be some obscure
++			 * use-case
++			 */
++warn:
++			WARN_ON_ONCE(1);
+ 			clear_page(kaddr);
+-		kunmap_atomic(kaddr);
+-		flush_dcache_page(dst);
+-	} else
+-		copy_user_highpage(dst, src, va, vma);
++		}
++	}
++
++	ret = true;
++
++pte_unlock:
++	if (locked)
++		pte_unmap_unlock(vmf->pte, vmf->ptl);
++	kunmap_atomic(kaddr);
++	flush_dcache_page(dst);
++
++	return ret;
+ }
+ 
+ static gfp_t __get_fault_gfp_mask(struct vm_area_struct *vma)
+@@ -2503,7 +2584,19 @@ static int wp_page_copy(struct vm_fault *vmf)
+ 				vmf->address);
+ 		if (!new_page)
+ 			goto oom;
+-		cow_user_page(new_page, old_page, vmf->address, vma);
++
++		if (!cow_user_page(new_page, old_page, vmf)) {
++			/*
++			 * COW failed, if the fault was solved by other,
++			 * it's fine. If not, userspace would re-fault on
++			 * the same address and we will handle the fault
++			 * from the second attempt.
++			 */
++			put_page(new_page);
++			if (old_page)
++				put_page(old_page);
++			return 0;
++		}
+ 	}
+ 
+ 	if (mem_cgroup_try_charge(new_page, mm, GFP_KERNEL, &memcg, false))
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 724b7c4f1a5b5..c389fd258384f 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2034,6 +2034,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	info.low_limit = mm->mmap_base;
+ 	info.high_limit = TASK_SIZE;
+ 	info.align_mask = 0;
++	info.align_offset = 0;
+ 	return vm_unmapped_area(&info);
+ }
+ #endif
+@@ -2075,6 +2076,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
+ 	info.high_limit = mm->mmap_base;
+ 	info.align_mask = 0;
++	info.align_offset = 0;
+ 	addr = vm_unmapped_area(&info);
+ 
+ 	/*
+diff --git a/mm/pagewalk.c b/mm/pagewalk.c
+index 23a3e415ac2ce..84bdb2bac3dc6 100644
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -15,9 +15,9 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ 		err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, walk);
+ 		if (err)
+ 		       break;
+-		addr += PAGE_SIZE;
+-		if (addr == end)
++		if (addr >= end - PAGE_SIZE)
+ 			break;
++		addr += PAGE_SIZE;
+ 		pte++;
+ 	}
+ 
+diff --git a/mm/swap_state.c b/mm/swap_state.c
+index 755be95d52f9c..3ceea86818bd4 100644
+--- a/mm/swap_state.c
++++ b/mm/swap_state.c
+@@ -524,10 +524,11 @@ static unsigned long swapin_nr_pages(unsigned long offset)
+ 		return 1;
+ 
+ 	hits = atomic_xchg(&swapin_readahead_hits, 0);
+-	pages = __swapin_nr_pages(prev_offset, offset, hits, max_pages,
++	pages = __swapin_nr_pages(READ_ONCE(prev_offset), offset, hits,
++				  max_pages,
+ 				  atomic_read(&last_readahead_pages));
+ 	if (!hits)
+-		prev_offset = offset;
++		WRITE_ONCE(prev_offset, offset);
+ 	atomic_set(&last_readahead_pages, pages);
+ 
+ 	return pages;
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 4f9e522643a2b..f79f0d938274a 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -973,7 +973,7 @@ start_over:
+ 			goto nextsi;
+ 		}
+ 		if (cluster) {
+-			if (!(si->flags & SWP_FILE))
++			if (si->flags & SWP_BLKDEV)
+ 				n_ret = swap_alloc_cluster(si, swp_entries);
+ 		} else
+ 			n_ret = scan_swap_map_slots(si, SWAP_HAS_CACHE,
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index c6962aa5ddb40..5ee6fbdec8a8d 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2950,8 +2950,9 @@ static bool allow_direct_reclaim(pg_data_t *pgdat)
+ 
+ 	/* kswapd must be awake if processes are being throttled */
+ 	if (!wmark_ok && waitqueue_active(&pgdat->kswapd_wait)) {
+-		pgdat->kswapd_classzone_idx = min(pgdat->kswapd_classzone_idx,
+-						(enum zone_type)ZONE_NORMAL);
++		if (READ_ONCE(pgdat->kswapd_classzone_idx) > ZONE_NORMAL)
++			WRITE_ONCE(pgdat->kswapd_classzone_idx, ZONE_NORMAL);
++
+ 		wake_up_interruptible(&pgdat->kswapd_wait);
+ 	}
+ 
+@@ -3451,9 +3452,9 @@ out:
+ static enum zone_type kswapd_classzone_idx(pg_data_t *pgdat,
+ 					   enum zone_type prev_classzone_idx)
+ {
+-	if (pgdat->kswapd_classzone_idx == MAX_NR_ZONES)
+-		return prev_classzone_idx;
+-	return pgdat->kswapd_classzone_idx;
++	enum zone_type curr_idx = READ_ONCE(pgdat->kswapd_classzone_idx);
++
++	return curr_idx == MAX_NR_ZONES ? prev_classzone_idx : curr_idx;
+ }
+ 
+ static void kswapd_try_to_sleep(pg_data_t *pgdat, int alloc_order, int reclaim_order,
+@@ -3497,8 +3498,11 @@ static void kswapd_try_to_sleep(pg_data_t *pgdat, int alloc_order, int reclaim_o
+ 		 * the previous request that slept prematurely.
+ 		 */
+ 		if (remaining) {
+-			pgdat->kswapd_classzone_idx = kswapd_classzone_idx(pgdat, classzone_idx);
+-			pgdat->kswapd_order = max(pgdat->kswapd_order, reclaim_order);
++			WRITE_ONCE(pgdat->kswapd_classzone_idx,
++				   kswapd_classzone_idx(pgdat, classzone_idx));
++
++			if (READ_ONCE(pgdat->kswapd_order) < reclaim_order)
++				WRITE_ONCE(pgdat->kswapd_order, reclaim_order);
+ 		}
+ 
+ 		finish_wait(&pgdat->kswapd_wait, &wait);
+@@ -3580,12 +3584,12 @@ static int kswapd(void *p)
+ 	tsk->flags |= PF_MEMALLOC | PF_SWAPWRITE | PF_KSWAPD;
+ 	set_freezable();
+ 
+-	pgdat->kswapd_order = 0;
+-	pgdat->kswapd_classzone_idx = MAX_NR_ZONES;
++	WRITE_ONCE(pgdat->kswapd_order, 0);
++	WRITE_ONCE(pgdat->kswapd_classzone_idx, MAX_NR_ZONES);
+ 	for ( ; ; ) {
+ 		bool ret;
+ 
+-		alloc_order = reclaim_order = pgdat->kswapd_order;
++		alloc_order = reclaim_order = READ_ONCE(pgdat->kswapd_order);
+ 		classzone_idx = kswapd_classzone_idx(pgdat, classzone_idx);
+ 
+ kswapd_try_sleep:
+@@ -3593,10 +3597,10 @@ kswapd_try_sleep:
+ 					classzone_idx);
+ 
+ 		/* Read the new order and classzone_idx */
+-		alloc_order = reclaim_order = pgdat->kswapd_order;
++		alloc_order = reclaim_order = READ_ONCE(pgdat->kswapd_order);
+ 		classzone_idx = kswapd_classzone_idx(pgdat, classzone_idx);
+-		pgdat->kswapd_order = 0;
+-		pgdat->kswapd_classzone_idx = MAX_NR_ZONES;
++		WRITE_ONCE(pgdat->kswapd_order, 0);
++		WRITE_ONCE(pgdat->kswapd_classzone_idx, MAX_NR_ZONES);
+ 
+ 		ret = try_to_freeze();
+ 		if (kthread_should_stop())
+@@ -3638,20 +3642,23 @@ kswapd_try_sleep:
+ void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx)
+ {
+ 	pg_data_t *pgdat;
++	enum zone_type curr_idx;
+ 
+ 	if (!managed_zone(zone))
+ 		return;
+ 
+ 	if (!cpuset_zone_allowed(zone, GFP_KERNEL | __GFP_HARDWALL))
+ 		return;
++
+ 	pgdat = zone->zone_pgdat;
++	curr_idx = READ_ONCE(pgdat->kswapd_classzone_idx);
++
++	if (curr_idx == MAX_NR_ZONES || curr_idx < classzone_idx)
++		WRITE_ONCE(pgdat->kswapd_classzone_idx, classzone_idx);
++
++	if (READ_ONCE(pgdat->kswapd_order) < order)
++		WRITE_ONCE(pgdat->kswapd_order, order);
+ 
+-	if (pgdat->kswapd_classzone_idx == MAX_NR_ZONES)
+-		pgdat->kswapd_classzone_idx = classzone_idx;
+-	else
+-		pgdat->kswapd_classzone_idx = max(pgdat->kswapd_classzone_idx,
+-						  classzone_idx);
+-	pgdat->kswapd_order = max(pgdat->kswapd_order, order);
+ 	if (!waitqueue_active(&pgdat->kswapd_wait))
+ 		return;
+ 
+diff --git a/net/atm/lec.c b/net/atm/lec.c
+index 85ce89c8a35c9..0b0794b6a8149 100644
+--- a/net/atm/lec.c
++++ b/net/atm/lec.c
+@@ -1282,6 +1282,12 @@ static void lec_arp_clear_vccs(struct lec_arp_table *entry)
+ 		entry->vcc = NULL;
+ 	}
+ 	if (entry->recv_vcc) {
++		struct atm_vcc *vcc = entry->recv_vcc;
++		struct lec_vcc_priv *vpriv = LEC_VCC_PRIV(vcc);
++
++		kfree(vpriv);
++		vcc->user_back = NULL;
++
+ 		entry->recv_vcc->push = entry->old_recv_push;
+ 		vcc_release_async(entry->recv_vcc, -EPIPE);
+ 		entry->recv_vcc = NULL;
+diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
+index ae647fa69ce85..ae1147b8710f3 100644
+--- a/net/batman-adv/bridge_loop_avoidance.c
++++ b/net/batman-adv/bridge_loop_avoidance.c
+@@ -36,6 +36,7 @@
+ #include <linux/lockdep.h>
+ #include <linux/netdevice.h>
+ #include <linux/netlink.h>
++#include <linux/preempt.h>
+ #include <linux/rculist.h>
+ #include <linux/rcupdate.h>
+ #include <linux/seq_file.h>
+@@ -95,11 +96,12 @@ static inline u32 batadv_choose_claim(const void *data, u32 size)
+  */
+ static inline u32 batadv_choose_backbone_gw(const void *data, u32 size)
+ {
+-	const struct batadv_bla_claim *claim = (struct batadv_bla_claim *)data;
++	const struct batadv_bla_backbone_gw *gw;
+ 	u32 hash = 0;
+ 
+-	hash = jhash(&claim->addr, sizeof(claim->addr), hash);
+-	hash = jhash(&claim->vid, sizeof(claim->vid), hash);
++	gw = (struct batadv_bla_backbone_gw *)data;
++	hash = jhash(&gw->orig, sizeof(gw->orig), hash);
++	hash = jhash(&gw->vid, sizeof(gw->vid), hash);
+ 
+ 	return hash % size;
+ }
+@@ -1825,7 +1827,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb,
+  * @bat_priv: the bat priv with all the soft interface information
+  * @skb: the frame to be checked
+  * @vid: the VLAN ID of the frame
+- * @is_bcast: the packet came in a broadcast packet type.
++ * @packet_type: the batman packet type this frame came in
+  *
+  * batadv_bla_rx avoidance checks if:
+  *  * we have to race for a claim
+@@ -1837,7 +1839,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb,
+  * further process the skb.
+  */
+ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+-		   unsigned short vid, bool is_bcast)
++		   unsigned short vid, int packet_type)
+ {
+ 	struct batadv_bla_backbone_gw *backbone_gw;
+ 	struct ethhdr *ethhdr;
+@@ -1859,9 +1861,24 @@ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+ 		goto handled;
+ 
+ 	if (unlikely(atomic_read(&bat_priv->bla.num_requests)))
+-		/* don't allow broadcasts while requests are in flight */
+-		if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast)
+-			goto handled;
++		/* don't allow multicast packets while requests are in flight */
++		if (is_multicast_ether_addr(ethhdr->h_dest))
++			/* Both broadcast flooding or multicast-via-unicasts
++			 * delivery might send to multiple backbone gateways
++			 * sharing the same LAN and therefore need to coordinate
++			 * which backbone gateway forwards into the LAN,
++			 * by claiming the payload source address.
++			 *
++			 * Broadcast flooding and multicast-via-unicasts
++			 * delivery use the following two batman packet types.
++			 * Note: explicitly exclude BATADV_UNICAST_4ADDR,
++			 * as the DHCP gateway feature will send explicitly
++			 * to only one BLA gateway, so the claiming process
++			 * should be avoided there.
++			 */
++			if (packet_type == BATADV_BCAST ||
++			    packet_type == BATADV_UNICAST)
++				goto handled;
+ 
+ 	ether_addr_copy(search_claim.addr, ethhdr->h_source);
+ 	search_claim.vid = vid;
+@@ -1896,13 +1913,14 @@ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+ 		goto allow;
+ 	}
+ 
+-	/* if it is a broadcast ... */
+-	if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast) {
++	/* if it is a multicast ... */
++	if (is_multicast_ether_addr(ethhdr->h_dest) &&
++	    (packet_type == BATADV_BCAST || packet_type == BATADV_UNICAST)) {
+ 		/* ... drop it. the responsible gateway is in charge.
+ 		 *
+-		 * We need to check is_bcast because with the gateway
++		 * We need to check packet type because with the gateway
+ 		 * feature, broadcasts (like DHCP requests) may be sent
+-		 * using a unicast packet type.
++		 * using a unicast 4 address packet type. See comment above.
+ 		 */
+ 		goto handled;
+ 	} else {
+diff --git a/net/batman-adv/bridge_loop_avoidance.h b/net/batman-adv/bridge_loop_avoidance.h
+index 234775748b8ea..e05809abf79cd 100644
+--- a/net/batman-adv/bridge_loop_avoidance.h
++++ b/net/batman-adv/bridge_loop_avoidance.h
+@@ -47,7 +47,7 @@ static inline bool batadv_bla_is_loopdetect_mac(const uint8_t *mac)
+ 
+ #ifdef CONFIG_BATMAN_ADV_BLA
+ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+-		   unsigned short vid, bool is_bcast);
++		   unsigned short vid, int packet_type);
+ bool batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb,
+ 		   unsigned short vid);
+ bool batadv_bla_is_backbone_gw(struct sk_buff *skb,
+@@ -78,7 +78,7 @@ bool batadv_bla_check_claim(struct batadv_priv *bat_priv, u8 *addr,
+ 
+ static inline bool batadv_bla_rx(struct batadv_priv *bat_priv,
+ 				 struct sk_buff *skb, unsigned short vid,
+-				 bool is_bcast)
++				 int packet_type)
+ {
+ 	return false;
+ }
+diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
+index f59aac06733e1..83f73f840ff91 100644
+--- a/net/batman-adv/routing.c
++++ b/net/batman-adv/routing.c
+@@ -822,6 +822,10 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
+ 	vid = batadv_get_vid(skb, hdr_len);
+ 	ethhdr = (struct ethhdr *)(skb->data + hdr_len);
+ 
++	/* do not reroute multicast frames in a unicast header */
++	if (is_multicast_ether_addr(ethhdr->h_dest))
++		return true;
++
+ 	/* check if the destination client was served by this node and it is now
+ 	 * roaming. In this case, it means that the node has got a ROAM_ADV
+ 	 * message and that it knows the new destination in the mesh to re-route
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 7c883420485b8..ba9dce04343a3 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -418,10 +418,10 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ 	struct vlan_ethhdr *vhdr;
+ 	struct ethhdr *ethhdr;
+ 	unsigned short vid;
+-	bool is_bcast;
++	int packet_type;
+ 
+ 	batadv_bcast_packet = (struct batadv_bcast_packet *)skb->data;
+-	is_bcast = (batadv_bcast_packet->packet_type == BATADV_BCAST);
++	packet_type = batadv_bcast_packet->packet_type;
+ 
+ 	skb_pull_rcsum(skb, hdr_size);
+ 	skb_reset_mac_header(skb);
+@@ -464,7 +464,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
+ 	/* Let the bridge loop avoidance check the packet. If will
+ 	 * not handle it, we can safely push it up.
+ 	 */
+-	if (batadv_bla_rx(bat_priv, skb, vid, is_bcast))
++	if (batadv_bla_rx(bat_priv, skb, vid, packet_type))
+ 		goto out;
+ 
+ 	if (orig_node)
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 70b8e2de40cf4..587b674bbcd64 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -41,12 +41,27 @@
+ 
+ /* Handle HCI Event packets */
+ 
+-static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
++static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
++				  u8 *new_status)
+ {
+ 	__u8 status = *((__u8 *) skb->data);
+ 
+ 	BT_DBG("%s status 0x%2.2x", hdev->name, status);
+ 
++	/* It is possible that we receive Inquiry Complete event right
++	 * before we receive Inquiry Cancel Command Complete event, in
++	 * which case the latter event should have status of Command
++	 * Disallowed (0x0c). This should not be treated as error, since
++	 * we actually achieve what Inquiry Cancel wants to achieve,
++	 * which is to end the last Inquiry session.
++	 */
++	if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
++		bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
++		status = 0x00;
++	}
++
++	*new_status = status;
++
+ 	if (status)
+ 		return;
+ 
+@@ -2772,7 +2787,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
+ 
+ 	switch (*opcode) {
+ 	case HCI_OP_INQUIRY_CANCEL:
+-		hci_cc_inquiry_cancel(hdev, skb);
++		hci_cc_inquiry_cancel(hdev, skb, status);
+ 		break;
+ 
+ 	case HCI_OP_PERIODIC_INQ:
+@@ -5257,6 +5272,11 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
+ 	u8 status = 0, event = hdr->evt, req_evt = 0;
+ 	u16 opcode = HCI_OP_NOP;
+ 
++	if (!event) {
++		bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
++		goto done;
++	}
++
+ 	if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
+ 		struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
+ 		opcode = __le16_to_cpu(cmd_hdr->opcode);
+@@ -5468,6 +5488,7 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
+ 		req_complete_skb(hdev, status, opcode, orig_skb);
+ 	}
+ 
++done:
+ 	kfree_skb(orig_skb);
+ 	kfree_skb(skb);
+ 	hdev->stat.evt_rx++;
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index ebdf1b0e576a5..c301b9debea7c 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -414,6 +414,9 @@ static void l2cap_chan_timeout(struct work_struct *work)
+ 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
+ 
+ 	mutex_lock(&conn->chan_lock);
++	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
++	 * this work. No need to call l2cap_chan_hold(chan) here again.
++	 */
+ 	l2cap_chan_lock(chan);
+ 
+ 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
+@@ -426,12 +429,12 @@ static void l2cap_chan_timeout(struct work_struct *work)
+ 
+ 	l2cap_chan_close(chan, reason);
+ 
+-	l2cap_chan_unlock(chan);
+-
+ 	chan->ops->close(chan);
+-	mutex_unlock(&conn->chan_lock);
+ 
++	l2cap_chan_unlock(chan);
+ 	l2cap_chan_put(chan);
++
++	mutex_unlock(&conn->chan_lock);
+ }
+ 
+ struct l2cap_chan *l2cap_chan_create(void)
+@@ -1725,9 +1728,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
+ 
+ 		l2cap_chan_del(chan, err);
+ 
+-		l2cap_chan_unlock(chan);
+-
+ 		chan->ops->close(chan);
++
++		l2cap_chan_unlock(chan);
+ 		l2cap_chan_put(chan);
+ 	}
+ 
+@@ -4114,7 +4117,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
+ 		return 0;
+ 	}
+ 
+-	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
++	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
++	    chan->state != BT_CONNECTED) {
+ 		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
+ 				       chan->dcid);
+ 		goto unlock;
+@@ -4337,6 +4341,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
+ 		return 0;
+ 	}
+ 
++	l2cap_chan_hold(chan);
+ 	l2cap_chan_lock(chan);
+ 
+ 	rsp.dcid = cpu_to_le16(chan->scid);
+@@ -4345,12 +4350,11 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
+ 
+ 	chan->ops->set_shutdown(chan);
+ 
+-	l2cap_chan_hold(chan);
+ 	l2cap_chan_del(chan, ECONNRESET);
+ 
+-	l2cap_chan_unlock(chan);
+-
+ 	chan->ops->close(chan);
++
++	l2cap_chan_unlock(chan);
+ 	l2cap_chan_put(chan);
+ 
+ 	mutex_unlock(&conn->chan_lock);
+@@ -4382,20 +4386,21 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
+ 		return 0;
+ 	}
+ 
++	l2cap_chan_hold(chan);
+ 	l2cap_chan_lock(chan);
+ 
+ 	if (chan->state != BT_DISCONN) {
+ 		l2cap_chan_unlock(chan);
++		l2cap_chan_put(chan);
+ 		mutex_unlock(&conn->chan_lock);
+ 		return 0;
+ 	}
+ 
+-	l2cap_chan_hold(chan);
+ 	l2cap_chan_del(chan, 0);
+ 
+-	l2cap_chan_unlock(chan);
+-
+ 	chan->ops->close(chan);
++
++	l2cap_chan_unlock(chan);
+ 	l2cap_chan_put(chan);
+ 
+ 	mutex_unlock(&conn->chan_lock);
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index 8c329c549ea60..511a1da6ca971 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1040,7 +1040,7 @@ done:
+ }
+ 
+ /* Kill socket (only if zapped and orphan)
+- * Must be called on unlocked socket.
++ * Must be called on unlocked socket, with l2cap channel lock.
+  */
+ static void l2cap_sock_kill(struct sock *sk)
+ {
+@@ -1191,6 +1191,7 @@ static int l2cap_sock_release(struct socket *sock)
+ {
+ 	struct sock *sk = sock->sk;
+ 	int err;
++	struct l2cap_chan *chan;
+ 
+ 	BT_DBG("sock %p, sk %p", sock, sk);
+ 
+@@ -1200,9 +1201,17 @@ static int l2cap_sock_release(struct socket *sock)
+ 	bt_sock_unlink(&l2cap_sk_list, sk);
+ 
+ 	err = l2cap_sock_shutdown(sock, 2);
++	chan = l2cap_pi(sk)->chan;
++
++	l2cap_chan_hold(chan);
++	l2cap_chan_lock(chan);
+ 
+ 	sock_orphan(sk);
+ 	l2cap_sock_kill(sk);
++
++	l2cap_chan_unlock(chan);
++	l2cap_chan_put(chan);
++
+ 	return err;
+ }
+ 
+@@ -1220,12 +1229,15 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
+ 		BT_DBG("child chan %p state %s", chan,
+ 		       state_to_string(chan->state));
+ 
++		l2cap_chan_hold(chan);
+ 		l2cap_chan_lock(chan);
++
+ 		__clear_chan_timer(chan);
+ 		l2cap_chan_close(chan, ECONNRESET);
+-		l2cap_chan_unlock(chan);
+-
+ 		l2cap_sock_kill(sk);
++
++		l2cap_chan_unlock(chan);
++		l2cap_chan_put(chan);
+ 	}
+ }
+ 
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 567e431813e59..20f6c634ad68a 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -2836,6 +2836,7 @@ static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ 		*pos = cpu+1;
+ 		return per_cpu_ptr(tbl->stats, cpu);
+ 	}
++	(*pos)++;
+ 	return NULL;
+ }
+ 
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 73cd64c7692f9..819d51101cbd9 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -73,6 +73,7 @@
+ #include <net/icmp.h>
+ #include <net/checksum.h>
+ #include <net/inetpeer.h>
++#include <net/inet_ecn.h>
+ #include <net/lwtunnel.h>
+ #include <linux/bpf-cgroup.h>
+ #include <linux/igmp.h>
+@@ -1562,7 +1563,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
+ 	if (IS_ERR(rt))
+ 		return;
+ 
+-	inet_sk(sk)->tos = arg->tos;
++	inet_sk(sk)->tos = arg->tos & ~INET_ECN_MASK;
+ 
+ 	sk->sk_priority = skb->priority;
+ 	sk->sk_protocol = ip_hdr(skb)->protocol;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index a894adbb6c9b5..6fcb12e083d99 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -276,6 +276,7 @@ static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ 		*pos = cpu+1;
+ 		return &per_cpu(rt_cache_stat, cpu);
+ 	}
++	(*pos)++;
+ 	return NULL;
+ 
+ }
+@@ -794,6 +795,8 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
+ 			if (fib_lookup(net, fl4, &res, 0) == 0) {
+ 				struct fib_nh *nh = &FIB_RES_NH(res);
+ 
++				fib_select_path(net, &res, fl4, skb);
++				nh = &FIB_RES_NH(res);
+ 				update_or_create_fnhe(nh, fl4->daddr, new_gw,
+ 						0, false,
+ 						jiffies + ip_rt_gc_timeout);
+@@ -1010,6 +1013,7 @@ out:	kfree_skb(skb);
+ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
+ {
+ 	struct dst_entry *dst = &rt->dst;
++	struct net *net = dev_net(dst->dev);
+ 	u32 old_mtu = ipv4_mtu(dst);
+ 	struct fib_result res;
+ 	bool lock = false;
+@@ -1030,9 +1034,11 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
+ 		return;
+ 
+ 	rcu_read_lock();
+-	if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) {
+-		struct fib_nh *nh = &FIB_RES_NH(res);
++	if (fib_lookup(net, fl4, &res, 0) == 0) {
++		struct fib_nh *nh;
+ 
++		fib_select_path(net, &res, fl4, NULL);
++		nh = &FIB_RES_NH(res);
+ 		update_or_create_fnhe(nh, fl4->daddr, 0, mtu, lock,
+ 				      jiffies + ip_rt_mtu_expires);
+ 	}
+@@ -2505,8 +2511,6 @@ struct rtable *ip_route_output_key_hash_rcu(struct net *net, struct flowi4 *fl4,
+ 	fib_select_path(net, res, fl4, skb);
+ 
+ 	dev_out = FIB_RES_DEV(*res);
+-	fl4->flowi4_oif = dev_out->ifindex;
+-
+ 
+ make_route:
+ 	rth = __mkroute_output(res, fl4, orig_oif, dev_out, flags);
+diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
+index 2d36fd0972990..a941f09a3fce9 100644
+--- a/net/ipv6/Kconfig
++++ b/net/ipv6/Kconfig
+@@ -321,6 +321,7 @@ config IPV6_SEG6_LWTUNNEL
+ config IPV6_SEG6_HMAC
+ 	bool "IPv6: Segment Routing HMAC support"
+ 	depends on IPV6
++	select CRYPTO
+ 	select CRYPTO_HMAC
+ 	select CRYPTO_SHA1
+ 	select CRYPTO_SHA256
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index f8f7065f7b627..0747747fffe58 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1855,6 +1855,13 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
+ 	if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
+ 		struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
+ 
++		if ((xfilter->sadb_x_filter_splen >=
++			(sizeof(xfrm_address_t) << 3)) ||
++		    (xfilter->sadb_x_filter_dplen >=
++			(sizeof(xfrm_address_t) << 3))) {
++			mutex_unlock(&pfk->dump_lock);
++			return -EINVAL;
++		}
+ 		filter = kmalloc(sizeof(*filter), GFP_KERNEL);
+ 		if (filter == NULL) {
+ 			mutex_unlock(&pfk->dump_lock);
+diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
+index bcd1a5e6ebf42..2f873a0dc5836 100644
+--- a/net/mac802154/tx.c
++++ b/net/mac802154/tx.c
+@@ -42,11 +42,11 @@ void ieee802154_xmit_worker(struct work_struct *work)
+ 	if (res)
+ 		goto err_tx;
+ 
+-	ieee802154_xmit_complete(&local->hw, skb, false);
+-
+ 	dev->stats.tx_packets++;
+ 	dev->stats.tx_bytes += skb->len;
+ 
++	ieee802154_xmit_complete(&local->hw, skb, false);
++
+ 	return;
+ 
+ err_tx:
+@@ -86,6 +86,8 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
+ 
+ 	/* async is priority, otherwise sync is fallback */
+ 	if (local->ops->xmit_async) {
++		unsigned int len = skb->len;
++
+ 		ret = drv_xmit_async(local, skb);
+ 		if (ret) {
+ 			ieee802154_wake_queue(&local->hw);
+@@ -93,7 +95,7 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
+ 		}
+ 
+ 		dev->stats.tx_packets++;
+-		dev->stats.tx_bytes += skb->len;
++		dev->stats.tx_bytes += len;
+ 	} else {
+ 		local->tx_skb = skb;
+ 		queue_work(local->workqueue, &local->tx_work);
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 7e5f849b44cdb..b293827b2a583 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -103,8 +103,17 @@ void svc_unreg_xprt_class(struct svc_xprt_class *xcl)
+ }
+ EXPORT_SYMBOL_GPL(svc_unreg_xprt_class);
+ 
+-/*
+- * Format the transport list for printing
++/**
++ * svc_print_xprts - Format the transport list for printing
++ * @buf: target buffer for formatted address
++ * @maxlen: length of target buffer
++ *
++ * Fills in @buf with a string containing a list of transport names, each name
++ * terminated with '\n'. If the buffer is too small, some entries may be
++ * missing, but it is guaranteed that all lines in the output buffer are
++ * complete.
++ *
++ * Returns positive length of the filled-in string.
+  */
+ int svc_print_xprts(char *buf, int maxlen)
+ {
+@@ -117,9 +126,9 @@ int svc_print_xprts(char *buf, int maxlen)
+ 	list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) {
+ 		int slen;
+ 
+-		sprintf(tmpstr, "%s %d\n", xcl->xcl_name, xcl->xcl_max_payload);
+-		slen = strlen(tmpstr);
+-		if (len + slen > maxlen)
++		slen = snprintf(tmpstr, sizeof(tmpstr), "%s %d\n",
++				xcl->xcl_name, xcl->xcl_max_payload);
++		if (slen >= sizeof(tmpstr) || len + slen >= maxlen)
+ 			break;
+ 		len += slen;
+ 		strcat(buf, tmpstr);
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+index af7893501e40a..4b9aaf487327c 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+@@ -270,6 +270,7 @@ xprt_rdma_bc_put(struct rpc_xprt *xprt)
+ {
+ 	dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
+ 
++	xprt_rdma_free_addresses(xprt);
+ 	xprt_free(xprt);
+ 	module_put(THIS_MODULE);
+ }
+diff --git a/net/tipc/msg.c b/net/tipc/msg.c
+index e383960258742..d048ec6dab12a 100644
+--- a/net/tipc/msg.c
++++ b/net/tipc/msg.c
+@@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
+ 	if (fragid == FIRST_FRAGMENT) {
+ 		if (unlikely(head))
+ 			goto err;
+-		if (unlikely(skb_unclone(frag, GFP_ATOMIC)))
++		frag = skb_unshare(frag, GFP_ATOMIC);
++		if (unlikely(!frag))
+ 			goto err;
+ 		head = *headbuf = frag;
+ 		*buf = NULL;
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index cbec2242f79ab..44ede9ab78985 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2126,10 +2126,7 @@ static int tipc_shutdown(struct socket *sock, int how)
+ 	lock_sock(sk);
+ 
+ 	__tipc_shutdown(sock, TIPC_CONN_SHUTDOWN);
+-	if (tipc_sk_type_connectionless(sk))
+-		sk->sk_shutdown = SHUTDOWN_MASK;
+-	else
+-		sk->sk_shutdown = SEND_SHUTDOWN;
++	sk->sk_shutdown = SHUTDOWN_MASK;
+ 
+ 	if (sk->sk_state == TIPC_DISCONNECTING) {
+ 		/* Discard any unreceived messages */
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 091e93798eacc..44ff3f5c22dfd 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -192,11 +192,17 @@ static inline int unix_may_send(struct sock *sk, struct sock *osk)
+ 	return unix_peer(osk) == NULL || unix_our_peer(sk, osk);
+ }
+ 
+-static inline int unix_recvq_full(struct sock const *sk)
++static inline int unix_recvq_full(const struct sock *sk)
+ {
+ 	return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
+ }
+ 
++static inline int unix_recvq_full_lockless(const struct sock *sk)
++{
++	return skb_queue_len_lockless(&sk->sk_receive_queue) >
++		READ_ONCE(sk->sk_max_ack_backlog);
++}
++
+ struct sock *unix_peer_get(struct sock *s)
+ {
+ 	struct sock *peer;
+@@ -1792,7 +1798,8 @@ restart_locked:
+ 	 * - unix_peer(sk) == sk by time of get but disconnected before lock
+ 	 */
+ 	if (other != sk &&
+-	    unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
++	    unlikely(unix_peer(other) != sk &&
++	    unix_recvq_full_lockless(other))) {
+ 		if (timeo) {
+ 			timeo = unix_wait_for_peer(other, timeo);
+ 
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 00eed842c491c..bf50fead9f8c0 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1425,6 +1425,7 @@ static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx)
+ 		*idx = cpu + 1;
+ 		return &per_cpu(avc_cache_stats, cpu);
+ 	}
++	(*idx)++;
+ 	return NULL;
+ }
+ 
+diff --git a/sound/hda/hdac_bus.c b/sound/hda/hdac_bus.c
+index 714a51721a313..ab9236e4c157e 100644
+--- a/sound/hda/hdac_bus.c
++++ b/sound/hda/hdac_bus.c
+@@ -155,6 +155,7 @@ static void process_unsol_events(struct work_struct *work)
+ 	struct hdac_driver *drv;
+ 	unsigned int rp, caddr, res;
+ 
++	spin_lock_irq(&bus->reg_lock);
+ 	while (bus->unsol_rp != bus->unsol_wp) {
+ 		rp = (bus->unsol_rp + 1) % HDA_UNSOL_QUEUE_SIZE;
+ 		bus->unsol_rp = rp;
+@@ -166,10 +167,13 @@ static void process_unsol_events(struct work_struct *work)
+ 		codec = bus->caddr_tbl[caddr & 0x0f];
+ 		if (!codec || !codec->dev.driver)
+ 			continue;
++		spin_unlock_irq(&bus->reg_lock);
+ 		drv = drv_to_hdac_driver(codec->dev.driver);
+ 		if (drv->unsol_event)
+ 			drv->unsol_event(codec, res);
++		spin_lock_irq(&bus->reg_lock);
+ 	}
++	spin_unlock_irq(&bus->reg_lock);
+ }
+ 
+ /**
+diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
+index b1a2a7ea41723..b4ccd9f92400e 100644
+--- a/sound/pci/asihpi/hpioctl.c
++++ b/sound/pci/asihpi/hpioctl.c
+@@ -350,7 +350,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev,
+ 	struct hpi_message hm;
+ 	struct hpi_response hr;
+ 	struct hpi_adapter adapter;
+-	struct hpi_pci pci;
++	struct hpi_pci pci = { 0 };
+ 
+ 	memset(&adapter, 0, sizeof(adapter));
+ 
+@@ -506,7 +506,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev,
+ 	return 0;
+ 
+ err:
+-	for (idx = 0; idx < HPI_MAX_ADAPTER_MEM_SPACES; idx++) {
++	while (--idx >= 0) {
+ 		if (pci.ap_mem_base[idx]) {
+ 			iounmap(pci.ap_mem_base[idx]);
+ 			pci.ap_mem_base[idx] = NULL;
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index fa261b27d8588..8198d2e53b7df 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -1169,16 +1169,23 @@ irqreturn_t azx_interrupt(int irq, void *dev_id)
+ 		if (snd_hdac_bus_handle_stream_irq(bus, status, stream_update))
+ 			active = true;
+ 
+-		/* clear rirb int */
+ 		status = azx_readb(chip, RIRBSTS);
+ 		if (status & RIRB_INT_MASK) {
++			/*
++			 * Clearing the interrupt status here ensures that no
++			 * interrupt gets masked after the RIRB wp is read in
++			 * snd_hdac_bus_update_rirb. This avoids a possible
++			 * race condition where codec response in RIRB may
++			 * remain unserviced by IRQ, eventually falling back
++			 * to polling mode in azx_rirb_get_response.
++			 */
++			azx_writeb(chip, RIRBSTS, RIRB_INT_MASK);
+ 			active = true;
+ 			if (status & RIRB_INT_RESPONSE) {
+ 				if (chip->driver_caps & AZX_DCAPS_CTX_WORKAROUND)
+ 					udelay(80);
+ 				snd_hdac_bus_update_rirb(bus);
+ 			}
+-			azx_writeb(chip, RIRBSTS, RIRB_INT_MASK);
+ 		}
+ 	} while (active && ++repeat < 10);
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 98110fd65b9bb..c27623052264b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3154,7 +3154,11 @@ static void alc256_shutup(struct hda_codec *codec)
+ 
+ 	/* 3k pull low control for Headset jack. */
+ 	/* NOTE: call this before clearing the pin, otherwise codec stalls */
+-	alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
++	/* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
++	 * when booting with headset plugged. So skip setting it for the codec alc257
++	 */
++	if (codec->core.vendor_id != 0x10ec0257)
++		alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+ 
+ 	snd_hda_codec_write(codec, hp_pin, 0,
+ 			    AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c
+index cf23af159acf4..35ca8e8bb5e52 100644
+--- a/sound/soc/kirkwood/kirkwood-dma.c
++++ b/sound/soc/kirkwood/kirkwood-dma.c
+@@ -136,7 +136,7 @@ static int kirkwood_dma_open(struct snd_pcm_substream *substream)
+ 		err = request_irq(priv->irq, kirkwood_dma_irq, IRQF_SHARED,
+ 				  "kirkwood-i2s", priv);
+ 		if (err)
+-			return -EBUSY;
++			return err;
+ 
+ 		/*
+ 		 * Enable Error interrupts. We're only ack'ing them but
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 1bfae7a1c32f1..a3d1c0c1b4a67 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1805,6 +1805,28 @@ static int snd_usbmidi_create_endpoints(struct snd_usb_midi *umidi,
+ 	return 0;
+ }
+ 
++static struct usb_ms_endpoint_descriptor *find_usb_ms_endpoint_descriptor(
++					struct usb_host_endpoint *hostep)
++{
++	unsigned char *extra = hostep->extra;
++	int extralen = hostep->extralen;
++
++	while (extralen > 3) {
++		struct usb_ms_endpoint_descriptor *ms_ep =
++				(struct usb_ms_endpoint_descriptor *)extra;
++
++		if (ms_ep->bLength > 3 &&
++		    ms_ep->bDescriptorType == USB_DT_CS_ENDPOINT &&
++		    ms_ep->bDescriptorSubtype == UAC_MS_GENERAL)
++			return ms_ep;
++		if (!extra[0])
++			break;
++		extralen -= extra[0];
++		extra += extra[0];
++	}
++	return NULL;
++}
++
+ /*
+  * Returns MIDIStreaming device capabilities.
+  */
+@@ -1842,11 +1864,8 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi,
+ 		ep = get_ep_desc(hostep);
+ 		if (!usb_endpoint_xfer_bulk(ep) && !usb_endpoint_xfer_int(ep))
+ 			continue;
+-		ms_ep = (struct usb_ms_endpoint_descriptor *)hostep->extra;
+-		if (hostep->extralen < 4 ||
+-		    ms_ep->bLength < 4 ||
+-		    ms_ep->bDescriptorType != USB_DT_CS_ENDPOINT ||
+-		    ms_ep->bDescriptorSubtype != UAC_MS_GENERAL)
++		ms_ep = find_usb_ms_endpoint_descriptor(hostep);
++		if (!ms_ep)
+ 			continue;
+ 		if (usb_endpoint_dir_out(ep)) {
+ 			if (endpoints[epidx].out_ep) {
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 4f4dc43e56a7b..224e0a7604282 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1322,12 +1322,13 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
+ 	    && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ 		mdelay(20);
+ 
+-	/* Zoom R16/24, Logitech H650e, Jabra 550a, Kingston HyperX needs a tiny
+-	 * delay here, otherwise requests like get/set frequency return as
+-	 * failed despite actually succeeding.
++	/* Zoom R16/24, Logitech H650e/H570e, Jabra 550a, Kingston HyperX
++	 *  needs a tiny delay here, otherwise requests like get/set
++	 *  frequency return as failed despite actually succeeding.
+ 	 */
+ 	if ((chip->usb_id == USB_ID(0x1686, 0x00dd) ||
+ 	     chip->usb_id == USB_ID(0x046d, 0x0a46) ||
++	     chip->usb_id == USB_ID(0x046d, 0x0a56) ||
+ 	     chip->usb_id == USB_ID(0x0b0e, 0x0349) ||
+ 	     chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
+ 	    (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+diff --git a/tools/gpio/gpio-hammer.c b/tools/gpio/gpio-hammer.c
+index 4bcb234c0fcab..3da5462a0c7d3 100644
+--- a/tools/gpio/gpio-hammer.c
++++ b/tools/gpio/gpio-hammer.c
+@@ -138,7 +138,14 @@ int main(int argc, char **argv)
+ 			device_name = optarg;
+ 			break;
+ 		case 'o':
+-			lines[i] = strtoul(optarg, NULL, 10);
++			/*
++			 * Avoid overflow. Do not immediately error, we want to
++			 * be able to accurately report on the amount of times
++			 * '-o' was given to give an accurate error message
++			 */
++			if (i < GPIOHANDLES_MAX)
++				lines[i] = strtoul(optarg, NULL, 10);
++
+ 			i++;
+ 			break;
+ 		case '?':
+@@ -146,6 +153,14 @@ int main(int argc, char **argv)
+ 			return -1;
+ 		}
+ 	}
++
++	if (i >= GPIOHANDLES_MAX) {
++		fprintf(stderr,
++			"Only %d occurences of '-o' are allowed, %d were found\n",
++			GPIOHANDLES_MAX, i + 1);
++		return -1;
++	}
++
+ 	nlines = i;
+ 
+ 	if (!device_name || !nlines) {
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 247fbb5f6a389..2c8e2dae17016 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -502,7 +502,7 @@ static int add_jump_destinations(struct objtool_file *file)
+ 		    insn->type != INSN_JUMP_UNCONDITIONAL)
+ 			continue;
+ 
+-		if (insn->ignore || insn->offset == FAKE_JUMP_OFFSET)
++		if (insn->offset == FAKE_JUMP_OFFSET)
+ 			continue;
+ 
+ 		rela = find_rela_by_dest_range(insn->sec, insn->offset,
+diff --git a/tools/perf/tests/shell/lib/probe_vfs_getname.sh b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
+index 068d463e5cbfc..4b0922a209701 100644
+--- a/tools/perf/tests/shell/lib/probe_vfs_getname.sh
++++ b/tools/perf/tests/shell/lib/probe_vfs_getname.sh
+@@ -14,7 +14,7 @@ add_probe_vfs_getname() {
+ 	if [ $had_vfs_getname -eq 1 ] ; then
+ 		line=$(perf probe -L getname_flags 2>&1 | egrep 'result.*=.*filename;' | sed -r 's/[[:space:]]+([[:digit:]]+)[[:space:]]+result->uptr.*/\1/')
+ 		perf probe -q       "vfs_getname=getname_flags:${line} pathname=result->name:string" || \
+-		perf probe $verbose "vfs_getname=getname_flags:${line} pathname=filename:string"
++		perf probe $verbose "vfs_getname=getname_flags:${line} pathname=filename:ustring"
+ 	fi
+ }
+ 
+diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
+index f93846edc1e0d..827d844f4efb1 100644
+--- a/tools/perf/util/cpumap.c
++++ b/tools/perf/util/cpumap.c
+@@ -462,7 +462,7 @@ static void set_max_cpu_num(void)
+ 
+ 	/* get the highest possible cpu number for a sparse allocation */
+ 	ret = snprintf(path, PATH_MAX, "%s/devices/system/cpu/possible", mnt);
+-	if (ret == PATH_MAX) {
++	if (ret >= PATH_MAX) {
+ 		pr_err("sysfs path crossed PATH_MAX(%d) size\n", PATH_MAX);
+ 		goto out;
+ 	}
+@@ -473,7 +473,7 @@ static void set_max_cpu_num(void)
+ 
+ 	/* get the highest present cpu number for a sparse allocation */
+ 	ret = snprintf(path, PATH_MAX, "%s/devices/system/cpu/present", mnt);
+-	if (ret == PATH_MAX) {
++	if (ret >= PATH_MAX) {
+ 		pr_err("sysfs path crossed PATH_MAX(%d) size\n", PATH_MAX);
+ 		goto out;
+ 	}
+@@ -501,7 +501,7 @@ static void set_max_node_num(void)
+ 
+ 	/* get the highest possible cpu number for a sparse allocation */
+ 	ret = snprintf(path, PATH_MAX, "%s/devices/system/node/possible", mnt);
+-	if (ret == PATH_MAX) {
++	if (ret >= PATH_MAX) {
+ 		pr_err("sysfs path crossed PATH_MAX(%d) size\n", PATH_MAX);
+ 		goto out;
+ 	}
+@@ -586,7 +586,7 @@ int cpu__setup_cpunode_map(void)
+ 		return 0;
+ 
+ 	n = snprintf(path, PATH_MAX, "%s/devices/system/node", mnt);
+-	if (n == PATH_MAX) {
++	if (n >= PATH_MAX) {
+ 		pr_err("sysfs path crossed PATH_MAX(%d) size\n", PATH_MAX);
+ 		return -1;
+ 	}
+@@ -601,7 +601,7 @@ int cpu__setup_cpunode_map(void)
+ 			continue;
+ 
+ 		n = snprintf(buf, PATH_MAX, "%s/%s", path, dent1->d_name);
+-		if (n == PATH_MAX) {
++		if (n >= PATH_MAX) {
+ 			pr_err("sysfs path crossed PATH_MAX(%d) size\n", PATH_MAX);
+ 			continue;
+ 		}
+diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
+index 84a33f1e9ec92..cd870129131e1 100644
+--- a/tools/perf/util/sort.c
++++ b/tools/perf/util/sort.c
+@@ -2667,7 +2667,7 @@ static char *prefix_if_not_in(const char *pre, char *str)
+ 		return str;
+ 
+ 	if (asprintf(&n, "%s,%s", pre, str) < 0)
+-		return NULL;
++		n = NULL;
+ 
+ 	free(str);
+ 	return n;
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 3d39332b3a06a..a0a4afa7e6781 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1420,6 +1420,7 @@ struct kcore_copy_info {
+ 	u64 first_symbol;
+ 	u64 last_symbol;
+ 	u64 first_module;
++	u64 first_module_symbol;
+ 	u64 last_module_symbol;
+ 	struct phdr_data kernel_map;
+ 	struct phdr_data modules_map;
+@@ -1434,6 +1435,8 @@ static int kcore_copy__process_kallsyms(void *arg, const char *name, char type,
+ 		return 0;
+ 
+ 	if (strchr(name, '[')) {
++		if (!kci->first_module_symbol || start < kci->first_module_symbol)
++			kci->first_module_symbol = start;
+ 		if (start > kci->last_module_symbol)
+ 			kci->last_module_symbol = start;
+ 		return 0;
+@@ -1558,6 +1561,10 @@ static int kcore_copy__calc_maps(struct kcore_copy_info *kci, const char *dir,
+ 		kci->etext += page_size;
+ 	}
+ 
++	if (kci->first_module_symbol &&
++	    (!kci->first_module || kci->first_module_symbol < kci->first_module))
++		kci->first_module = kci->first_module_symbol;
++
+ 	kci->first_module = round_down(kci->first_module, page_size);
+ 
+ 	if (kci->last_module_symbol) {
+diff --git a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
+index 0b24dd9d01ff2..98c9f2df8aa71 100755
+--- a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
++++ b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
+@@ -10,11 +10,11 @@ then this utility enables and collects trace data for a user specified interval
+ and generates performance plots.
+ 
+ Prerequisites:
+-    Python version 2.7.x
++    Python version 2.7.x or higher
+     gnuplot 5.0 or higher
+-    gnuplot-py 1.8
++    gnuplot-py 1.8 or higher
+     (Most of the distributions have these required packages. They may be called
+-     gnuplot-py, phython-gnuplot. )
++     gnuplot-py, phython-gnuplot or phython3-gnuplot, gnuplot-nox, ... )
+ 
+     HWP (Hardware P-States are disabled)
+     Kernel config for Linux trace is enabled
+@@ -178,7 +178,7 @@ def plot_pstate_cpu_with_sample():
+         g_plot('set xlabel "Samples"')
+         g_plot('set ylabel "P-State"')
+         g_plot('set title "{} : cpu pstate vs. sample : {:%F %H:%M}"'.format(testname, datetime.now()))
+-        title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++        title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+         plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_SAMPLE, C_TO)
+         g_plot('title_list = "{}"'.format(title_list))
+         g_plot(plot_str)
+@@ -195,7 +195,7 @@ def plot_pstate_cpu():
+ #    the following command is really cool, but doesn't work with the CPU masking option because it aborts on the first missing file.
+ #    plot_str = 'plot for [i=0:*] file=sprintf("cpu%03d.csv",i) title_s=sprintf("cpu%03d",i) file using 16:7 pt 7 ps 1 title title_s'
+ #
+-    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+     plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_TO)
+     g_plot('title_list = "{}"'.format(title_list))
+     g_plot(plot_str)
+@@ -209,7 +209,7 @@ def plot_load_cpu():
+     g_plot('set ylabel "CPU load (percent)"')
+     g_plot('set title "{} : cpu loads : {:%F %H:%M}"'.format(testname, datetime.now()))
+ 
+-    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+     plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_LOAD)
+     g_plot('title_list = "{}"'.format(title_list))
+     g_plot(plot_str)
+@@ -223,7 +223,7 @@ def plot_frequency_cpu():
+     g_plot('set ylabel "CPU Frequency (GHz)"')
+     g_plot('set title "{} : cpu frequencies : {:%F %H:%M}"'.format(testname, datetime.now()))
+ 
+-    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+     plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_FREQ)
+     g_plot('title_list = "{}"'.format(title_list))
+     g_plot(plot_str)
+@@ -238,7 +238,7 @@ def plot_duration_cpu():
+     g_plot('set ylabel "Timer Duration (MilliSeconds)"')
+     g_plot('set title "{} : cpu durations : {:%F %H:%M}"'.format(testname, datetime.now()))
+ 
+-    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+     plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_DURATION)
+     g_plot('title_list = "{}"'.format(title_list))
+     g_plot(plot_str)
+@@ -252,7 +252,7 @@ def plot_scaled_cpu():
+     g_plot('set ylabel "Scaled Busy (Unitless)"')
+     g_plot('set title "{} : cpu scaled busy : {:%F %H:%M}"'.format(testname, datetime.now()))
+ 
+-    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+     plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_SCALED)
+     g_plot('title_list = "{}"'.format(title_list))
+     g_plot(plot_str)
+@@ -266,7 +266,7 @@ def plot_boost_cpu():
+     g_plot('set ylabel "CPU IO Boost (percent)"')
+     g_plot('set title "{} : cpu io boost : {:%F %H:%M}"'.format(testname, datetime.now()))
+ 
+-    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+     plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_BOOST)
+     g_plot('title_list = "{}"'.format(title_list))
+     g_plot(plot_str)
+@@ -280,7 +280,7 @@ def plot_ghz_cpu():
+     g_plot('set ylabel "TSC Frequency (GHz)"')
+     g_plot('set title "{} : cpu TSC Frequencies (Sanity check calculation) : {:%F %H:%M}"'.format(testname, datetime.now()))
+ 
+-    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).replace('\n', ' ')
++    title_list = subprocess.check_output('ls cpu???.csv | sed -e \'s/.csv//\'',shell=True).decode('utf-8').replace('\n', ' ')
+     plot_str = "plot for [i in title_list] i.'.csv' using {:d}:{:d} pt 7 ps 1 title i".format(C_ELAPSED, C_GHZ)
+     g_plot('title_list = "{}"'.format(title_list))
+     g_plot(plot_str)
+diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
+index 27a54a17da65d..f4e92afab14b2 100644
+--- a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
+@@ -30,7 +30,7 @@ ftrace_filter_check '*schedule*' '^.*schedule.*$'
+ ftrace_filter_check 'schedule*' '^schedule.*$'
+ 
+ # filter by *mid*end
+-ftrace_filter_check '*aw*lock' '.*aw.*lock$'
++ftrace_filter_check '*pin*lock' '.*pin.*lock$'
+ 
+ # filter by start*mid*
+ ftrace_filter_check 'mutex*try*' '^mutex.*try.*'
+diff --git a/tools/testing/selftests/x86/syscall_nt.c b/tools/testing/selftests/x86/syscall_nt.c
+index 43fcab367fb0a..74e6b3fc2d09e 100644
+--- a/tools/testing/selftests/x86/syscall_nt.c
++++ b/tools/testing/selftests/x86/syscall_nt.c
+@@ -67,6 +67,7 @@ static void do_it(unsigned long extraflags)
+ 	set_eflags(get_eflags() | extraflags);
+ 	syscall(SYS_getpid);
+ 	flags = get_eflags();
++	set_eflags(X86_EFLAGS_IF | X86_EFLAGS_FIXED);
+ 	if ((flags & extraflags) == extraflags) {
+ 		printf("[OK]\tThe syscall worked and flags are still set\n");
+ 	} else {
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 71f77ae6c2a66..c1ca4d40157b1 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -165,6 +165,7 @@ bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
+ 	 */
+ 	if (pfn_valid(pfn))
+ 		return PageReserved(pfn_to_page(pfn)) &&
++		       !is_zero_pfn(pfn) &&
+ 		       !kvm_is_zone_device_pfn(pfn);
+ 
+ 	return true;
+@@ -3688,7 +3689,7 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
+ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+ 			       struct kvm_io_device *dev)
+ {
+-	int i;
++	int i, j;
+ 	struct kvm_io_bus *new_bus, *bus;
+ 
+ 	bus = kvm_get_bus(kvm, bus_idx);
+@@ -3705,17 +3706,20 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+ 
+ 	new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
+ 			  sizeof(struct kvm_io_range)), GFP_KERNEL);
+-	if (!new_bus)  {
++	if (new_bus) {
++		memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
++		new_bus->dev_count--;
++		memcpy(new_bus->range + i, bus->range + i + 1,
++		       (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
++	} else {
+ 		pr_err("kvm: failed to shrink bus, removing it completely\n");
+-		goto broken;
++		for (j = 0; j < bus->dev_count; j++) {
++			if (j == i)
++				continue;
++			kvm_iodevice_destructor(bus->range[j].dev);
++		}
+ 	}
+ 
+-	memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
+-	new_bus->dev_count--;
+-	memcpy(new_bus->range + i, bus->range + i + 1,
+-	       (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
+-
+-broken:
+ 	rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
+ 	synchronize_srcu_expedited(&kvm->srcu);
+ 	kfree(bus);